09b25f421a7e8beda58978dfc5ddea254d59c595dcac7f2ed8f799963111ae9b

Analysis

max time kernel
138s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2023, 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OfficeClickToRun.exe
Size

5.0MB
MD5

305b489297b55ca1a0ea90104635a57d
SHA1

70f6653d653b8aa1727241d687e75e10e8113412
SHA256

09b25f421a7e8beda58978dfc5ddea254d59c595dcac7f2ed8f799963111ae9b
SHA512

cfc4ea7b324aa3891df390b0f535a69b625100216d87a214e18e51f34aa4043cadefa718912c483bf39c497a195b5abbc418e8e5bd75f942ed47c751b29c7466
SSDEEP

98304:hgrgH1HJzOyoKD1i5D+ZAzruaI6HMaJTtGbd:eK1ppoKxi5DQVaI6HMaJTtGbd

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OfficeClickToRun.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\83ffae87-9ea7-4a5e-837a-3da0f534c0f2.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230516195142.pma	setup.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
2852	identity_helper.exe
2852	identity_helper.exe
5448	msedge.exe
5448	msedge.exe
5448	msedge.exe
5448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	firefox.exe
Token: SeDebugPrivilege	1280	firefox.exe

Suspicious use of FindShellTrayWindow 16 IoCs

pid	Process
1280	firefox.exe
1280	firefox.exe
1280	firefox.exe
1280	firefox.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
1280	firefox.exe
1280	firefox.exe
1280	firefox.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2636	OfficeClickToRun.exe
4152	OfficeClickToRun.exe
1280	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 4152	2636	OfficeClickToRun.exe	82
PID 2636 wrote to memory of 4152	2636	OfficeClickToRun.exe	82
PID 1856 wrote to memory of 1280	1856	firefox.exe	86
PID 1856 wrote to memory of 1280	1856	firefox.exe	86
PID 1856 wrote to memory of 1280	1856	firefox.exe	86
PID 1856 wrote to memory of 1280	1856	firefox.exe	86
PID 1856 wrote to memory of 1280	1856	firefox.exe	86
PID 1856 wrote to memory of 1280	1856	firefox.exe	86
PID 1856 wrote to memory of 1280	1856	firefox.exe	86
PID 1856 wrote to memory of 1280	1856	firefox.exe	86
PID 1856 wrote to memory of 1280	1856	firefox.exe	86
PID 1856 wrote to memory of 1280	1856	firefox.exe	86
PID 1856 wrote to memory of 1280	1856	firefox.exe	86
PID 1280 wrote to memory of 1704	1280	firefox.exe	89
PID 1280 wrote to memory of 1704	1280	firefox.exe	89
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 772	1280	firefox.exe	91
PID 1280 wrote to memory of 2136	1280	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\OfficeClickToRun.exe
"C:\Users\Admin\AppData\Local\Temp\OfficeClickToRun.exe"
1⤵
- Checks computer location settings
- Checks system information in the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
  OfficeClickToRun.exe platform=
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of SetWindowsHookEx
  PID:4152

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1280.0.233849852\322003997" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a793029d-759f-41e5-ab94-718ce479003d} 1280 "\\.\pipe\gecko-crash-server-pipe.1280" 1932 26ef1e16258 gpu
    3⤵
    PID:1704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1280.1.1348829371\336883984" -parentBuildID 20221007134813 -prefsHandle 2320 -prefMapHandle 2316 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2042d9d6-b7ae-496b-be6a-8f82dcc7a4fa} 1280 "\\.\pipe\gecko-crash-server-pipe.1280" 2332 26ee3e72b58 socket
    3⤵
    - Checks processor information in registry
    PID:772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1280.2.982179162\1112042406" -childID 1 -isForBrowser -prefsHandle 2948 -prefMapHandle 2988 -prefsLen 21009 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbe99a24-4fc7-4140-9b0d-bd70380b03c8} 1280 "\\.\pipe\gecko-crash-server-pipe.1280" 2940 26ef4af7858 tab
    3⤵
    PID:2136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1280.3.195525283\1730541402" -childID 2 -isForBrowser -prefsHandle 1648 -prefMapHandle 3548 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21718b81-cefe-48ba-8dba-eb34612cd64d} 1280 "\\.\pipe\gecko-crash-server-pipe.1280" 3540 26ee3e63858 tab
    3⤵
    PID:4248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1280.4.282030034\1469856896" -childID 3 -isForBrowser -prefsHandle 3532 -prefMapHandle 3544 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {298805fe-9149-483e-980c-161da038143d} 1280 "\\.\pipe\gecko-crash-server-pipe.1280" 4044 26ef3e33658 tab
    3⤵
    PID:1684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1280.5.1281095874\1888270675" -childID 4 -isForBrowser -prefsHandle 4960 -prefMapHandle 4956 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69c3da15-25f9-4967-9c98-64b70bb93099} 1280 "\\.\pipe\gecko-crash-server-pipe.1280" 4900 26ef6cc9458 tab
    3⤵
    PID:3104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1280.7.1410267999\1863374289" -childID 6 -isForBrowser -prefsHandle 5292 -prefMapHandle 5296 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c3fc9e8-9234-4356-bac8-9edfac04eb11} 1280 "\\.\pipe\gecko-crash-server-pipe.1280" 5376 26ef7273658 tab
    3⤵
    PID:1304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1280.6.564593968\1237606818" -childID 5 -isForBrowser -prefsHandle 5096 -prefMapHandle 5100 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c2748b5-f43a-4868-adba-a1048835a338} 1280 "\\.\pipe\gecko-crash-server-pipe.1280" 4736 26ef7274e58 tab
    3⤵
    PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff81c8d46f8,0x7ff81c8d4708,0x7ff81c8d4718
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12146799974776697241,14098442285522653645,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12146799974776697241,14098442285522653645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,12146799974776697241,14098442285522653645,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12146799974776697241,14098442285522653645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12146799974776697241,14098442285522653645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12146799974776697241,14098442285522653645,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12146799974776697241,14098442285522653645,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2636 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12146799974776697241,14098442285522653645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7a9c75460,0x7ff7a9c75470,0x7ff7a9c75480
    3⤵
    PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12146799974776697241,14098442285522653645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12146799974776697241,14098442285522653645,131072 --disable-databases --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12146799974776697241,14098442285522653645,131072 --disable-databases --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12146799974776697241,14098442285522653645,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12146799974776697241,14098442285522653645,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12146799974776697241,14098442285522653645,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12146799974776697241,14098442285522653645,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A7891822FCFF127E4EADADE9757112B

Filesize
926B

MD5
924b4a6d631fcd26e75ed685d03d6fca

SHA1
27eb297fc65d84462359b0c63b8b619dc1581a48

SHA256
f65517f65e172a39a084f079ac883bfc8f3242a78964e0941d1b3d37afcc17c0

SHA512
cd0e4eddc300c8896f03d2687857c2bd6a0c705860c5869091db8ab06712e3751487e8842b0252797f6ac4c49ec7195873356359bfd6b63338a463f4786e0f4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B

Filesize
246B

MD5
67f03cd78642cbd2991c679b701499f2

SHA1
c41a707ada48a548acc57f178886774bb032a662

SHA256
2cad03bc0aa15d82da2c6d4a24c4159fd39d9e90a5de6c66469b18ddb00e6226

SHA512
5e8c77c39131e1a6b8b639b8bee7cc8c00ff70d8586c19a0e772c52ad86e22f75ebe43004ab524c96f5afd65b26f074680b58ffbd10b8fbe2920e80bea783424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
dd71e7fcfc7c16f75865739ba78d1d7b

SHA1
fe348de767e43fdae6d6338c0c7b582383ec9698

SHA256
b23fe1f00c2c956ffd33b4d7ec199ec954ab280a9e7d77788afe74590dde50d8

SHA512
af4f801376ab742a37c98923243ea927dcbe36feb32d4d59fe6a184227ace81c51a56842a9c51db7c2db821105aa4a9f414d69fb0c35a9975502d23fce7f3360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d2496edc623482a2bfb4fad8c1953a1f

SHA1
b156074e2f1ee387f9226b431a2f6d5becdf995e

SHA256
09b6a701b816e23c31aaa2717f9d9e1290461cf4f278c5552451b4db53d5b6d4

SHA512
cd5982365a9d31aac6dd7d4225d819b90a380347bda7375623c734c500b4e66792ab151e8f6a97ec4fcee05a1172263d3e794eda66e9f3d435b8dda01035cefa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
4bec56f1d2d6ca555b0bf6861bb2f4f4

SHA1
84776df13b2c728053419c7675e2a187b7651c03

SHA256
d1bf88d45129442c10081771775b40eac81b90f51e0b344f602b63836fa06dda

SHA512
cbdec8ae24e3d6afb9d91bc8e5b68decab4738343f3360304a764791c8cf7173abcd1e896d2974b6dd2c22f9d88bf7faa08979371c6d33617b8228ead85f8687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1993dbb0cb71b75b33b76e9730188645

SHA1
262cab8c66be2b26c2ad6a253fbd8e66d73a08ea

SHA256
41cc34d1627fb74f08f8ad4f08a197f21957c81b89debe14d7fc31e63d350417

SHA512
f6d6b245341c7a5242caaafa12911e6ae911fc3a4b39de4434c44256787a69db4a53eb7966bebca399ce1aaa748b28898406f2f38884653b0c128e610b721283

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5edab6d3ffbeee247ccb4423f929a323

SHA1
a4ad201d149d59392a2a3163bd86ee900e20f3d9

SHA256
460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

SHA512
263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
784a51387993e9aeb34d4ad4ed93ab48

SHA1
1cbf9ea1b6c2ea18c8670f26ebf9c11d7d245bc4

SHA256
567af49b26f4676e8c8ad07b34db13ae7a9e19ba01e6bd1af390a611b44413f8

SHA512
ba34c55cea5840723b16f09f0a790f823a5a65657f8163018cbfcbc3a13c83b1b4b6a1f8ca0fe188c1ba7d78cc9319889235c0f6042a2013755fc6d820e4b9e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5894c0df5d9a66d743560b0e48438395

SHA1
3b4cc6036f4ccdcf314eb00dc83a66b98ddb7be1

SHA256
0a8d67064d62b3a0de83b33b0812dab8a011434cfc8708c68813136439f539ce

SHA512
e3e2f6755ae9d440e135973afeda5ae695380fea88e31de39a49ac6b4f3de368b614c0902e6d32450f9352c1d5949086178267096a25a70729daaa7709c7eea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
30858519e33ca81bd13b990d707d7591

SHA1
3d9561218080de5af171566d237c74cda63fcde5

SHA256
1fd73cf0ae8ae97d13afaf1f82f96f79b61622639c40b2582ee48088b0b9eb7d

SHA512
a80e83ea44a64762e63019e3f0e896d6dd5d456024ed7be84beea39910c9da638d64fed1d67d25a10aee01c0f15e2004c14ce9d630e359599390bb5aba9fac47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-wal

Filesize
8KB

MD5
36af85db6a4217fee48964851d9ca550

SHA1
0bab2000288573a70e9bcc3c31514d503bf2c05c

SHA256
393365788d7f287266e1b923ffcfea2abbab4605a3af12719988d9d8e986d833

SHA512
ce2b847fb1bbb2480ecdcc1d76c13e137fb06ac2d5799f2e1b55b1fbe2b54f84519309ddbfc5388f6a38a02761dbc9ed235142366de5224fc258c07308fe8b69

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bozzcyfh.default-release\activity-stream.discovery_stream.json.tmp

Filesize
146KB

MD5
463b215acaa056898524b97f4e75096e

SHA1
07d7632ca91a68407321df1d07e53c165a51a47a

SHA256
09c5f45d795d2fc84def791c196a84c8d3576370c731cf3c576ca704b818ba98

SHA512
3aa786de91f8378e1840f23208318d7b0f4d9413884db3611ffc6c48cdb06ef806e7ac3f4cc17048c995620f086fbc796edf7e4b985e386b63111362737d09df

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
b5613ad3e1e77734f1ddc29a14e576db

SHA1
e8f80c7e3053a5128d97b70168a462d47bb36e81

SHA256
16356390fc56005bdb4585e9ecea1cd9a08603045bf57418dabc1879faa938b4

SHA512
a0c8f2444360d458cb2c97a4e2866d07ae8a33e7970ce0253568dcabc1237f6096eb4ea541e4e4cf005019e847ea2395c17872f36a018fd58a45ec6a05f92306

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js

Filesize
6KB

MD5
4f2a98391d125e14c9ce3447340796e2

SHA1
b8d7c981828ea5861762bf7044b84994f3f9752a

SHA256
9ff406959a794fd092b23ef0d98f5cc28fed51dfc8c933f872e07a2b0114b6b1

SHA512
096a7fd73cc59580cf1d084c903b28876a3fefa13e489ff56adc75e4dad793c80d79d34c1ffd7cf43cb14654f97c22b4612d4c1d6ef96e0d42e5a282fc273ce4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs.js

Filesize
6KB

MD5
fcd5f37e5e4066f7cffe8eb106b6ce19

SHA1
b0a1c4d3d5c96271429fb09cb71055d177c13402

SHA256
38dbdb91f24f8e138803d71d0f7e4758fbb78e7f657208325fe30a501e225c67

SHA512
afdf7697bc784c3c85f30a8a1e4caa32459cf7f19c1ffacde04f62f089218ff1899ffe69fc465677d719546c8f91bea0d04807b13d58096f79aeba8eef0a0a15

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\sessionstore.jsonlz4

Filesize
880B

MD5
875136f2409f3174e7951d0844f2185d

SHA1
223a3910f647afbf50f68d1bc5e9669a4499cf84

SHA256
8841ed0c4c2d150293e598d4b143de2664bebefd8d156a0e0cf1ff31747f5aaf

SHA512
c0052c704b6af80b7972351f3eb2c4e751b2dfbacf16ff3fd7ca54acd12d7c416ac698c0ce5d65cf66c13d0c4f4993bfe4990812206e65b60dcf4fb61f91a0ec

Download Submit