b3c4da1f3286ca29ee153bef94130e7793bb8a8c8a97a235aaa1e005a3469dc6

Analysis

max time kernel
40s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2023 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Custom ghost client - Linkvertise Downloader_IJ-wb61.exe
Size

10.8MB
MD5

67707d9fc692b89e0dcf6b6ddb5e4f58
SHA1

af304643d22047b4df87d9835b764eba3e549b4c
SHA256

b3c4da1f3286ca29ee153bef94130e7793bb8a8c8a97a235aaa1e005a3469dc6
SHA512

781ee9e8dc450e090a9a7d44a45258b9f44c59b83d4adb9cebee7895e20f1e623bbd2491115b51d4a8103a580a918bc250b9b349d4b4e3ad94e47e721df98535
SSDEEP

196608:R38JJEU16hTZl583S0LJu+mzfDkzXJKUNWGJ3k2ZoXOM1ughpQQBG/h:21MlCC0Ybzf4zZKUok5oXN86ns/h

Score

6^/10

Malware Config

Signatures

Checks for any installed AV software in registry 1 TTPs 6 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\AVAST Software\Avast	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\AVG\AV\Dir	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7830bb57-5276-461d-b5d1-5b0ce36acc51.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230531183627.pma	setup.exe

Executes dropped EXE 1 IoCs

pid	Process
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp

Loads dropped DLL 4 IoCs

pid	Process
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	17	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
2940	msedge.exe
2940	msedge.exe
3348	msedge.exe
3348	msedge.exe
2904	identity_helper.exe
2904	identity_helper.exe
5228	msedge.exe
5228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 1900	4356	Custom ghost client - Linkvertise Downloader_IJ-wb61.exe	86
PID 4356 wrote to memory of 1900	4356	Custom ghost client - Linkvertise Downloader_IJ-wb61.exe	86
PID 4356 wrote to memory of 1900	4356	Custom ghost client - Linkvertise Downloader_IJ-wb61.exe	86
PID 1900 wrote to memory of 3348	1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp	91
PID 1900 wrote to memory of 3348	1900	Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp	91
PID 3348 wrote to memory of 4644	3348	msedge.exe	92
PID 3348 wrote to memory of 4644	3348	msedge.exe	92
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 912	3348	msedge.exe	94
PID 3348 wrote to memory of 2940	3348	msedge.exe	95
PID 3348 wrote to memory of 2940	3348	msedge.exe	95
PID 3348 wrote to memory of 4888	3348	msedge.exe	98
PID 3348 wrote to memory of 4888	3348	msedge.exe	98
PID 3348 wrote to memory of 4888	3348	msedge.exe	98
PID 3348 wrote to memory of 4888	3348	msedge.exe	98
PID 3348 wrote to memory of 4888	3348	msedge.exe	98
PID 3348 wrote to memory of 4888	3348	msedge.exe	98
PID 3348 wrote to memory of 4888	3348	msedge.exe	98
PID 3348 wrote to memory of 4888	3348	msedge.exe	98
PID 3348 wrote to memory of 4888	3348	msedge.exe	98
PID 3348 wrote to memory of 4888	3348	msedge.exe	98
PID 3348 wrote to memory of 4888	3348	msedge.exe	98
PID 3348 wrote to memory of 4888	3348	msedge.exe	98
PID 3348 wrote to memory of 4888	3348	msedge.exe	98
PID 3348 wrote to memory of 4888	3348	msedge.exe	98
PID 3348 wrote to memory of 4888	3348	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\Custom ghost client - Linkvertise Downloader_IJ-wb61.exe
"C:\Users\Admin\AppData\Local\Temp\Custom ghost client - Linkvertise Downloader_IJ-wb61.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Users\Admin\AppData\Local\Temp\is-5T3CR.tmp\Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5T3CR.tmp\Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp" /SL5="$901C2,10377886,1235456,C:\Users\Admin\AppData\Local\Temp\Custom ghost client - Linkvertise Downloader_IJ-wb61.exe"
  2⤵
  - Checks for any installed AV software in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://workupload.com/file/9E9Jvr2ANGy
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xdc,0x104,0x7ffe6b4246f8,0x7ffe6b424708,0x7ffe6b424718
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
      4⤵
      PID:3920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
      4⤵
      PID:508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
      4⤵
      PID:3284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5312 /prefetch:8
      4⤵
      PID:692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
      4⤵
      PID:64
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6640 /prefetch:8
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:2448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff755dc5460,0x7ff755dc5470,0x7ff755dc5480
        5⤵
        
        PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6640 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6132 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13258544403513379810,17774585480476700162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
      4⤵
      PID:5508

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Security Software Discovery

T1063

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae2c65ccf1085f2a624551421576a3ee

SHA1
f1dea6ccfbd7803cc4489b9260758b8ad053e08e

SHA256
49bfbbfbdb367d1c91863108c87b4f2f2cfffbbbb5e9c1256344bc7f52038c54

SHA512
3abbfbb4804c6b1d1a579e56a04057f5d9c52cfd48ecbae42d919398f70da2eacd5a35cb3c3d0a559ad3515fadb1734b0d47be48dce0fdd9fd11578948a6c7ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
18KB

MD5
1ccdd691a59e35712101a172571e8522

SHA1
056bd349a7fbb671de88bfb4e6e4613b17ce1b30

SHA256
03aa6a31e9605240f1c5536634e51fa21b7b21a77ec8583ce91b9bd58cc7f73d

SHA512
7fc91314d86f8a1df4c6d57830bd6e2333a45a26464caa17465794ce3591e89380a5bbafef3c3558e32bcbabb5e4bf26b1087def39ba0188ac339ba0d0bac212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
35KB

MD5
13e4d59d50a6bff5efd85da44e39f120

SHA1
250a20ccce38d0d74465fb91f75ed26268dea8e0

SHA256
91dc38122a363debc8e11f2307fbbcbdcafd7001f72cdb5d4d0ca2fb6690a337

SHA512
8f11f584cfd7b460fc2fd9cd90a56bba6298ecfb26ec235f043a176a80a1b19edfd7b1e94a69f3ce1da45a11ea2367f67d963dc178e3fb76cf08710b6eaeaf24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
93KB

MD5
863d5b5d8b7661c310266a0e8b653b9a

SHA1
98a90507dd8530eefee422d33563a0cbcbdb356e

SHA256
2d4a1f159f7337a1054002ac1e06144abe01b15c62f0b330c784af1ba5902a5f

SHA512
1a9a77cfcf604cdaa600f5014e2186083d19af3aae3f9ab7dda82afb892f5f3cc7290c4d9f10fa08352afdbc6aa22acd4e92faf3a08f37f1d87b35a3c7972684

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
e232467513b671739051029981e9a342

SHA1
2202e7a06a8f71be40ffd05e352bbb796b1919fc

SHA256
106cd8624989baf71ce006f6f825b7dcec02e2798bd025787df76be1aecc0bf4

SHA512
b8b279c461c027f3112677bcad558a51afecde57528a7ef906c87c7a70dd18aca545a136aecc7619674282b02f4cfdd6257c181e3d46a288c887ffe60828062e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
a3b5832a3b17ec1a400f8dadec809724

SHA1
ff7d0f320d56ef5de050858535e875477bfbeb33

SHA256
18ab89ba0ce2426980a7cf88de3af4da6bec6706a86570020d0b334f5799d18e

SHA512
0d0ef04d5b4c527997f79b3d9ec77177ad1368729914ed8db1e9a0ff4b09fba2ecdf46fc1f099f1580e1336882a37970574aa868d062643326fa267328e84b5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
83bbc7e118af795191e5f5e2004352f8

SHA1
7c266700b9ef6e8839aa6b68fbc539539291eba9

SHA256
7b8033c0b92b2eb7f41bfabc60a2d46ffa6fe9d1459ec8788ac8ee198fcd3ab4

SHA512
5e3cce2cbd5fa63bd05a09c6d7ee96bd652aa4f65b3e8f0056f767bde06621e564879c5ac9638d83cd2da1aa987c937019636576b661bda7c1fa97a2eca0f31f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f6e22512861b3dee6a029291eccbabb1

SHA1
511fed6615200ca6f55bd7aeae6c5a8ca4be7956

SHA256
694b5cff4383ddeb1567868c1e0cf0e6641c7b40c4e84756a897621f1364ebad

SHA512
32ada89576fadb889b812305c89be4dc3768bd829a103672347217ca90ccbf2f81e2d506c9a04bb3bd61115d5b7c8993a54e9373b21475c2933db05a5065573a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b3fbb8a02260d5e41407a7e1af3ee2f6

SHA1
9180c8b9593405936b0fe52272571b63829525d4

SHA256
8c1434a31409aa606a51bdae37e0853597cb408a2cf199f05e02705df3fc15de

SHA512
8a6ec40722054025a8969a80e795b026fc806a0710eb2f9e016feb68cc09a19333404a8a62910e9b0335729fd64e8e1b6250513ffc334dc8d669d96de62eb5d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
cfd585ce0db9a1484f8223dc2cfce2f8

SHA1
4e5e287160c05ecdff8acdfa0899faa5bad4de82

SHA256
0bcae3ddcadfadb917e4f910daefde07af8d2708b7795f3a1146102dcf6cf445

SHA512
b45dd6c3231a79155508d807d4b6f839d49e6120841c4f31147a83039515d3358822fa1fa4ae6f770b4369b96f221326c0b80dc2f0cd99d605440b12c93fb648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
88a35332ae16553e61432ace33532bfc

SHA1
3804c7d627d66f14b0cf0641ec8856325d4e3663

SHA256
f9ab20b8095de182cb24e153c11720347fdad7eed750017cfa8872bf4a8c242f

SHA512
66bbe5bfb2b0fba5d2626786fedf1ea35ed1c8629c3033211ed3318b55f7d8b0adaf946923570e2d40547d0a2d181a32043400d56ceb70a4a4aa1a384de87344

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8991079e7f85ff27801872e1afa2045a

SHA1
bf1ee34198e22a2f373cc2a61deb6dc1b92bff19

SHA256
cf757a55232ec40511f48cd3045f57c03d81f206b60b6ea93cf514b6d7341c5f

SHA512
35ceea8d2701779e316dea5d63079fafd5e7fe1b19e029cc73037103c90cccf9634e6985d6293851b0797b9f7f555ebc874e9094594b37d67911cd3b096b6469

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5T3CR.tmp\Custom ghost client - Linkvertise Downloader_IJ-wb61.tmp

Filesize
3.3MB

MD5
85041dcf9c01a109650e246ad62aa873

SHA1
a0f8c1ced7d11105f91b599ebef5c8a860f99d76

SHA256
14636eec24dd231f1c34d6d5baf7321cee394585c8335bd752ca9b792bbde009

SHA512
1146c4a45d2b3234a8d7c82a7ad298cbe8010f17023fbd460163e69d2f93a15b7cb198645f77652da0c68d2de1e2236844a746e855ec033a6233acb5143e2cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C7OIK.tmp\AVAST.png

Filesize
64KB

MD5
096ff7dbb7f5dfb71cf40fcd37a59fd6

SHA1
5cc8f2256ae43e597edaf7841771d7471d8d0590

SHA256
6197d9ad63a37760e88b7ee53077faf94d0deeb9d8740428d2dc76a7242d7843

SHA512
8a37e62cdd1989443f1ac98c0e827cdbdd00f1a9d243e7b433ce1bf5dbdd05c8e1c7fdc07261086c18b6e39d2494c3b2acaac60a24bec84f4631f295efc4891d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C7OIK.tmp\AppUtils.dll

Filesize
1.8MB

MD5
43ce6d593abd5141a3139603f352ae05

SHA1
a97c75e23d275dddfde15ef5fdf3ff3253c0992c

SHA256
94e874f2702ea6be50e7d74864b66e7f763449c3db237803f3fad6adfd64ed3d

SHA512
bfc527529e5f73ba190dfc5bd043175c7e2ae963b665d6d39421c29e025020f1d593dc88b7bee33d86ef6b4f7a4c5e1a0339df4e99cab6849a275d1dda9f439f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C7OIK.tmp\DimensionUtils.dll

Filesize
1.9MB

MD5
ce2dc2cc12aec529511da19cf63ba802

SHA1
5b45c33a34df73920077f546176a3aa96df0f80e

SHA256
bde7cc0193ad2fbdfa9f072d9003bf1c82cd27e027b2e038343514f8cc8ee6d2

SHA512
98b5017e437b05639238b63bdf6cccdea7665f3fa0c55e87e8c7139551c213b1a63d641d588b950346ec66bb03b4800dc4e3dd4c60f80e0e76779b1ba58d2be7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C7OIK.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C7OIK.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C7OIK.tmp\side-logo.png

Filesize
29KB

MD5
06b0076d9f4e2488d32855a0161e9c74

SHA1
7dbc3c098f7fb1256aeca79c256b75802b5fdd69

SHA256
929243f002eb4209a9e68af6744a3d63ece2b173c910a59d6752536dabf3870b

SHA512
7cecc1fc1c13f97dfe1ae7592918c9df16233851a8dd667ac2199b92fd24410a6ef76acfa014cd00aad2d27dfe2887f41100563cf2240f720466dbebaed0375a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
7ee0f47c0224c6f867979772fff431d2

SHA1
df3c0d3bdad7dbf551a099775096b8f406f206e4

SHA256
31da27a0dfc56f001d8e1a6a3ec141eadbf9e0e2c6cbdc5c92d337290806d42f

SHA512
6ad38b2c33b8954b7a3da17e9ccc6d73605f46b33a90c2a9b8116a2c40ca1c6e69316fe8e419bdd9b06d20a2b28b5cb61dc09566979560461e09171eedbe1974

Download Submit
C:\Users\Admin\Downloads\BetterTimeChanger-1.1.jar

Filesize
167KB

MD5
51e6dcd5ac430cf46d4d5db5a20971c0

SHA1
256bb2f306c7b23b420a932de662b13f8a4a3035

SHA256
dea47b8625602e4287f0e6edb58a84b1b24d5d4c5865286248ba559cb6fcb01c

SHA512
43d52bd7e01c412f4d189b6ac23a0387a832348d9e544ee3d1a2bb3e0c9b9fb4492756f741741319376eada70f8ba84f569cd0738ab866592ee4bc0574ad31bb

Download Submit
memory/1900-179-0x0000000005AA0000-0x0000000005AAF000-memory.dmp

Filesize
60KB

Download
memory/1900-178-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/1900-159-0x0000000005AA0000-0x0000000005AAF000-memory.dmp

Filesize
60KB

Download
memory/1900-150-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/1900-180-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/1900-193-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/4356-177-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/4356-195-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/4356-133-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download