44caliber | d3e832fc80acdc65b025a2f2ddf27f9b6ee273434a9f57df9a5afe977dfdcac3

Resubmissions

24-09-2023 08:26

230924-kcbw1aeg88 10

22-08-2023 14:37

230822-rzc6xacg63 10

Analysis

max time kernel
292s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2023 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EXPENSIVE LOADER.exe
Size

1.3MB
MD5

bfb9334833749790c0df81ab1489c5a9
SHA1

b38e3080dfb1d35ae303b9f0c14a7cf12621de7c
SHA256

cc16768fe66b11c07282c6d5d543701b85b283a44de51fdd4a9bd2a014f37b68
SHA512

e41a66d9932f7853c9015ef0361cfbf4702a31d356e97dae1fb9ece085b808cac0e9a5d6d70a2763d08b3f940aacc074181bae6755077933d97f9a92b93c65d1
SSDEEP

24576:bw3SBs2Mhfs2OcpIi5aO9z1dn7Az8Zk61NlPXYpky7vKCB/nO:E3P2MhkPTaz1tswiKPXYpkyjKCB/O

Score

10^/10

44caliber spyware stealer

Malware Config

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

EXPENSIVE LOADER.exe

pid process

836 EXPENSIVE LOADER.exe
836 EXPENSIVE LOADER.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXPENSIVE LOADER.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	EXPENSIVE LOADER.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	EXPENSIVE LOADER.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

EXPENSIVE LOADER.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	EXPENSIVE LOADER.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	EXPENSIVE LOADER.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	EXPENSIVE LOADER.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	EXPENSIVE LOADER.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 5c0000000100000004000000000800001900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d040000000100000010000000410352dc0ff7501b16f0028eba6f45c520000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	EXPENSIVE LOADER.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

EXPENSIVE LOADER.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
836	EXPENSIVE LOADER.exe
836	EXPENSIVE LOADER.exe
2488	msedge.exe
2488	msedge.exe
2068	msedge.exe
2068	msedge.exe
836	EXPENSIVE LOADER.exe
836	EXPENSIVE LOADER.exe
836	EXPENSIVE LOADER.exe
836	EXPENSIVE LOADER.exe
864	identity_helper.exe
864	identity_helper.exe
836	EXPENSIVE LOADER.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2068 msedge.exe
2068 msedge.exe
2068 msedge.exe
2068 msedge.exe
2068 msedge.exe
2068 msedge.exe
2068 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

EXPENSIVE LOADER.exe

description pid process

Token: SeDebugPrivilege 836 EXPENSIVE LOADER.exe

description	pid	process
Token: SeDebugPrivilege	836	EXPENSIVE LOADER.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

EXPENSIVE LOADER.exe

pid process

836 EXPENSIVE LOADER.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

EXPENSIVE LOADER.exemsedge.exe

description	pid	process	target process
PID 836 wrote to memory of 2068	836	EXPENSIVE LOADER.exe	msedge.exe
PID 836 wrote to memory of 2068	836	EXPENSIVE LOADER.exe	msedge.exe
PID 2068 wrote to memory of 4844	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 4844	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1392	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 2488	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 2488	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe
PID 2068 wrote to memory of 1196	2068	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\EXPENSIVE LOADER.exe
"C:\Users\Admin\AppData\Local\Temp\EXPENSIVE LOADER.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.enigmaprotector.com/
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea1d746f8,0x7ffea1d74708,0x7ffea1d74718
3⤵
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3135455880749065681,4112881471142306402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
3⤵
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,3135455880749065681,4112881471142306402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,3135455880749065681,4112881471142306402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
3⤵
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3135455880749065681,4112881471142306402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
3⤵
PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3135455880749065681,4112881471142306402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
3⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3135455880749065681,4112881471142306402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
3⤵
PID:496

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3135455880749065681,4112881471142306402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
3⤵
PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3135455880749065681,4112881471142306402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3135455880749065681,4112881471142306402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
3⤵
PID:996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3135455880749065681,4112881471142306402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
3⤵
PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3135455880749065681,4112881471142306402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
3⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3135455880749065681,4112881471142306402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
3⤵
PID:2312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Process.txt

Filesize
1KB

MD5
ef32c7674d7dc8a2b7ed0e18883c9e13

SHA1
32274530f6a9b7d41efe0735ba13c5f0a1c49269

SHA256
0259b66fdc942a34c257a1da000acee83ac6547828739249833407bb95636084

SHA512
c092d14e5518ff71a8113c1e2d700891ef82aac0adb769894bcca3a122a218b6a4cff82836fbe8df86c92ed82ae40adb4795f946e7cc5ff04f8b5f58b77ade78

Download Submit
C:\ProgramData\44\Process.txt

Filesize
1KB

MD5
ef32c7674d7dc8a2b7ed0e18883c9e13

SHA1
32274530f6a9b7d41efe0735ba13c5f0a1c49269

SHA256
0259b66fdc942a34c257a1da000acee83ac6547828739249833407bb95636084

SHA512
c092d14e5518ff71a8113c1e2d700891ef82aac0adb769894bcca3a122a218b6a4cff82836fbe8df86c92ed82ae40adb4795f946e7cc5ff04f8b5f58b77ade78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
cdbd4d61ee5f7b8fd2a7ed3dc148b2ed

SHA1
48867e3602132c7da748ba6c344ff2e01f3e263d

SHA256
ccfcd5d27abc363ece545eb40e5f9b7f5938006f8032df84ff42fc89e3a7032c

SHA512
37fa00eae48e1e6df121acddc3a45844c6c88d77a44a894c6daaddad8c0504dace813e9a9a3eb426aaab34acbd95b117bb4ca944bba1c489c9d9f32dd1eaa6cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
606B

MD5
f7d07f0db5e44f2769545c93f591475e

SHA1
d5631ec90fb09c05a8ca2b3d146f473a56bf0c2f

SHA256
412df546db645b49a7815789080e2342845006c13f7da88d15add4f4a220933e

SHA512
40674ab6743f70ff002e6812bcd6c174b3424575380c5adfc77c9e8d086f473d72b19239f7fe22c32aae83257cb86ed0ca941644a5ca5238f112919b2e87a587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
90049a2348c409006c25fd6d585b8305

SHA1
800aa11ac0fa029336822aa8a54bd5b09492fb1a

SHA256
6945117d8bb1456281ceb6f6d66b35eb8ef8f61bfeffa7e3b236b774559a38e8

SHA512
502aa15da4d8edbbb2bfcb24ed94ecd3ffa618485b0ff89593ea7263bd574ced426dc0a40b089d26af96265d08b03f035ca543b190acff76b59cfc5d9ec247dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8fd327c155c0763ca9de364d5e8b320e

SHA1
750214c1f0ea5e2639fbf54513104288dddd552a

SHA256
eb9b80835e0ab9155f59d829260486307e9e1bc7216340b44551ba2fb0bddc26

SHA512
16d2e1b92e474967df3025fd7a854ed0f3443f3f37d36315ca175efb5f1b180147ff451ae6d1d86f94c046bdd1d4dc58966447bf943d7e33162043f02f14813d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aad7bf84dde5f6090c68ec7b8b3d6526

SHA1
efbb410ab2e0c5439c9bf69ce77c2915623af074

SHA256
13c14ab7f416c0d96db5296e0a625431e06091102477606d9c967c575036bdbb

SHA512
6edd9f775b57bd228557438c8d42cb676921122526b74a0ff435c04e726ee67fb93143e018009b2e2d7247a8cbbfc1e48962b197895f6f17407268f8c5b8c7eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d985875547ce8936a14b00d1e571365f

SHA1
040d8e5bd318357941fca03b49f66a1470824cb3

SHA256
8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf

SHA512
ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e113d7140abbd11bd47f6071fd43b9a8

SHA1
d4f98fbeca46b0d61dc7626d487740175a3bc897

SHA256
71a25e3339d7d4906fed5972fa33b91bc9b79dde5bf2f3c95dad7d8dc9c7d6dd

SHA512
301dcafbb52cae65e6d334840c58bbc87e866ea6a3f2e72dbf528de7bd7baed6af458d814ac23e2f7cd57ccea37516e5895b2b0c801168c831f0ba6b6b15d796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
53ae26fb2e3f1c018e148b1d3fa61489

SHA1
e954706eff17e651d001b7f276be9a55744caec9

SHA256
f79d3d8263dcb6bccdd4e43475b3abc59a1ccce1e1bf37220e3040815f6a2953

SHA512
df571274261deb631c4fcf2e357cc50cff94f5f976f77920421f03fd53d3bf2cc67bb31306d36bc36e157ae2c6e6a343314f592e07fdef8cf654db8c976aa24a

Download Submit
\??\pipe\LOCAL\crashpad_2068_RQUMRHABKNKTNMPG

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/836-49-0x0000000000EA0000-0x00000000012AA000-memory.dmp

Filesize
4.0MB

Download
memory/836-0-0x0000000000EA0000-0x00000000012AA000-memory.dmp

Filesize
4.0MB

Download
memory/836-48-0x0000000000EA0000-0x00000000012AA000-memory.dmp

Filesize
4.0MB

Download
memory/836-199-0x000000000A0A0000-0x000000000A106000-memory.dmp

Filesize
408KB

Download
memory/836-203-0x0000000000EA0000-0x00000000012AA000-memory.dmp

Filesize
4.0MB

Download
memory/836-209-0x0000000000EA0000-0x00000000012AA000-memory.dmp

Filesize
4.0MB

Download
memory/836-210-0x00000000723A0000-0x0000000072B50000-memory.dmp

Filesize
7.7MB

Download
memory/836-52-0x0000000001570000-0x0000000001580000-memory.dmp

Filesize
64KB

Download
memory/836-47-0x00000000723A0000-0x0000000072B50000-memory.dmp

Filesize
7.7MB

Download
memory/836-97-0x000000000AF30000-0x000000000B4D4000-memory.dmp

Filesize
5.6MB

Download
memory/836-21-0x0000000077422000-0x0000000077423000-memory.dmp

Filesize
4KB

Download
memory/836-74-0x000000000A8E0000-0x000000000A972000-memory.dmp

Filesize
584KB

Download
memory/836-9-0x0000000000EA0000-0x00000000012AA000-memory.dmp

Filesize
4.0MB

Download
memory/836-2-0x0000000000EA0000-0x00000000012AA000-memory.dmp

Filesize
4.0MB

Download
memory/836-1-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download