8fd95aee88007ae1ccee591367191234de3bc70fd1f5c51c25aaefef016e3ce2

Analysis

max time kernel
62s
max time network
100s
platform
windows10-1703_x64
resource
win10-20231023-en
resource tags

arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system
submitted
15/11/2023, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eReceipt--yQ2IT1XliAPMKzDXCRzo3dLKbkaLlTAZM5oEQQiWqoTs6WZ2Cj_C9omxYS_ .html
Size

743B
MD5

c3b3b545f68e735630b597d78dcd939c
SHA1

05df2a2445b1832c31290430c750d667e365ffb5
SHA256

8fd95aee88007ae1ccee591367191234de3bc70fd1f5c51c25aaefef016e3ce2
SHA512

c7c3602e32e016e7c6ce47f4a4f4981245919cee4fa34164e19921fcb3e4d4bf3f1892efd148cf013ceeb7af871280fa81794f3acd5de48361e1b344cc7f06e9

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31070175"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1695999898"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100ca165df17da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90A85656-83D2-11EE-A45E-DA59F11AE14F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3009380cde65040b8b5729e980be04000000000020000000000106600000001000020000000f3888948bb7f770ffb6eff199999e441a38e29242047731080e9cc7d6db76a47000000000e8000000002000020000000b77ab80d8ac173c3119672b2eebae2d4ee43fc0933757faa057be8479cb6591120000000401adf21e0d2b3d2da3ee91f42e7e8f3aae9bebca2bec4dec7f8a36b3ff8f6af400000008dae431a1a50ed42604de645fe05692afc73b77b86cafc8dee8189f5f337e96c2b237a60e3bc8d3dd4114e3e2b86391164c5ac38a9f26a2e347de5e6341a177e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1694749986"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1694749986"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50739565df17da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31070175"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31070175"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3009380cde65040b8b5729e980be04000000000020000000000106600000001000020000000e16f63ce3ce0935823a8f5ad02420a768eee7511cbd0365001c3c552b1bb9030000000000e8000000002000020000000747903096fce5dd8e83892e5ee266cdd9f50ea58aca2f2aeba38e20993a7a34f2000000004ee1a0dd833c52a63b9a7c5218775d07ce85920a4312937db88661f28874b97400000001a9cbb81e24a20ac88939a60454ea01afab3a92c5c2d822213a654bd764567812bf5c94ed8b1cd88aba69e4bb2c438a6b05c445f0bba1ec457d87650eca4eddf	iexplore.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a225ac75df17da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "544"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "23"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "23"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "605"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{D87E4043-BCB9-4B10-9C60-8F6A34B377DA} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "605"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 14b59474df17da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 424c5d76df17da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "544"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
5152	MicrosoftEdgeCP.exe
5152	MicrosoftEdgeCP.exe
5152	MicrosoftEdgeCP.exe
5152	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	448	firefox.exe
Token: SeDebugPrivilege	448	firefox.exe
Token: SeDebugPrivilege	5232	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5232	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5232	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5232	MicrosoftEdgeCP.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4248	iexplore.exe
448	firefox.exe
448	firefox.exe
448	firefox.exe
448	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
448	firefox.exe
448	firefox.exe
448	firefox.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
4248	iexplore.exe
4248	iexplore.exe
4056	IEXPLORE.EXE
4056	IEXPLORE.EXE
4056	IEXPLORE.EXE
4056	IEXPLORE.EXE
448	firefox.exe
448	firefox.exe
448	firefox.exe
448	firefox.exe
4116	MicrosoftEdge.exe
5152	MicrosoftEdgeCP.exe
5232	MicrosoftEdgeCP.exe
5152	MicrosoftEdgeCP.exe
4116	MicrosoftEdge.exe
4116	MicrosoftEdge.exe
5532	MicrosoftEdgeCP.exe
5784	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4056	4248	iexplore.exe	71
PID 4248 wrote to memory of 4056	4248	iexplore.exe	71
PID 4248 wrote to memory of 4056	4248	iexplore.exe	71
PID 5116 wrote to memory of 448	5116	firefox.exe	74
PID 5116 wrote to memory of 448	5116	firefox.exe	74
PID 5116 wrote to memory of 448	5116	firefox.exe	74
PID 5116 wrote to memory of 448	5116	firefox.exe	74
PID 5116 wrote to memory of 448	5116	firefox.exe	74
PID 5116 wrote to memory of 448	5116	firefox.exe	74
PID 5116 wrote to memory of 448	5116	firefox.exe	74
PID 5116 wrote to memory of 448	5116	firefox.exe	74
PID 5116 wrote to memory of 448	5116	firefox.exe	74
PID 5116 wrote to memory of 448	5116	firefox.exe	74
PID 5116 wrote to memory of 448	5116	firefox.exe	74
PID 448 wrote to memory of 4352	448	firefox.exe	75
PID 448 wrote to memory of 4352	448	firefox.exe	75
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76
PID 448 wrote to memory of 2248	448	firefox.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\eReceipt--yQ2IT1XliAPMKzDXCRzo3dLKbkaLlTAZM5oEQQiWqoTs6WZ2Cj_C9omxYS_ .html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4248 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4056

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.0.1077351483\1730047820" -parentBuildID 20221007134813 -prefsHandle 1696 -prefMapHandle 1688 -prefsLen 20936 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9dbc2640-cd9b-426b-9f62-64b8649dd689} 448 "\\.\pipe\gecko-crash-server-pipe.448" 1776 151d56d8a58 gpu
    3⤵
    PID:4352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.1.1038115662\1721842398" -parentBuildID 20221007134813 -prefsHandle 2120 -prefMapHandle 2116 -prefsLen 21017 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a257683-30b5-412c-8eee-492816743e23} 448 "\\.\pipe\gecko-crash-server-pipe.448" 2132 151d55f9e58 socket
    3⤵
    PID:2248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.2.1347897407\1436799827" -childID 1 -isForBrowser -prefsHandle 2948 -prefMapHandle 2944 -prefsLen 21120 -prefMapSize 232675 -jsInitHandle 1236 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c54463ee-3bc7-41c8-9a34-27f5f6a4a03d} 448 "\\.\pipe\gecko-crash-server-pipe.448" 2960 151d5661458 tab
    3⤵
    PID:3260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.3.956026752\1192819993" -childID 2 -isForBrowser -prefsHandle 3636 -prefMapHandle 3632 -prefsLen 26480 -prefMapSize 232675 -jsInitHandle 1236 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82a61beb-d9f1-4083-97a7-176b0d7afb9b} 448 "\\.\pipe\gecko-crash-server-pipe.448" 3648 151da7d8958 tab
    3⤵
    PID:1212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.4.818283789\1482892400" -childID 3 -isForBrowser -prefsHandle 3892 -prefMapHandle 3888 -prefsLen 26480 -prefMapSize 232675 -jsInitHandle 1236 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {54f34057-29b9-40a0-abb7-43e034f3f246} 448 "\\.\pipe\gecko-crash-server-pipe.448" 3904 151da94cb58 tab
    3⤵
    PID:4740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.5.1784343151\203630454" -childID 4 -isForBrowser -prefsHandle 4848 -prefMapHandle 4840 -prefsLen 26620 -prefMapSize 232675 -jsInitHandle 1236 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {281b6e77-986c-4dce-8fa8-3f0d62ca64af} 448 "\\.\pipe\gecko-crash-server-pipe.448" 2632 151dbeae558 tab
    3⤵
    PID:3424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.6.1096655190\2055858911" -childID 5 -isForBrowser -prefsHandle 5056 -prefMapHandle 5052 -prefsLen 26620 -prefMapSize 232675 -jsInitHandle 1236 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bdf0a971-ac98-4219-aced-15c0a3d94a70} 448 "\\.\pipe\gecko-crash-server-pipe.448" 5064 151dbead958 tab
    3⤵
    PID:3736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.7.1155189621\900845830" -childID 6 -isForBrowser -prefsHandle 5168 -prefMapHandle 5172 -prefsLen 26620 -prefMapSize 232675 -jsInitHandle 1236 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b990c21c-3849-40ce-9cd9-7d18d64c17d0} 448 "\\.\pipe\gecko-crash-server-pipe.448" 5156 151dbeadf58 tab
    3⤵
    PID:3724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="448.8.691629052\1166843764" -childID 7 -isForBrowser -prefsHandle 5196 -prefMapHandle 5220 -prefsLen 26699 -prefMapSize 232675 -jsInitHandle 1236 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6abe8fc-fe8d-43a0-a4f9-df8db00d5d1d} 448 "\\.\pipe\gecko-crash-server-pipe.448" 4976 151dc9dfa58 tab
    3⤵
    PID:1900

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4116

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4772

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5152

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5232

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5320

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5532

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5704

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5784

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5900

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7020

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
2e57fd32f357c037e8248d353f61a241

SHA1
b7e741d41ca04caf06a71d4bf2f11aa693128d96

SHA256
3528b2181d9d044ff8f6f1b76299ac46be573295987a07fb6d839bdb7f822862

SHA512
5fc3945b317447907642aea4bde8d8b06f8e049359c16b837eba5b78b26d7b712d6a68e9ca2dfd32a4f4d57dcdef29f9d8752f584191074423bc6058e4aeab1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
83235a862596eb89dcf0cf369e1b57eb

SHA1
10907c69a793f59f0d727d5ce99a6d071a888bfb

SHA256
6a669bcd6866468813b4dd1b59eba2cf659d70957b5da59b92581e6f4971c2cc

SHA512
b383df0b2bb6c5ab20c060175f50324b9f2f1e038b7906135d091fac10fdacfc6244fc587a03e000cc3971f36967b2a4c3c1acb1b8269162939ba955ca69424a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\41C7Q4SX\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YZUNXYOV\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\AGZ5WB79.cookie

Filesize
542B

MD5
fe8ba11556571b11589eed4759d2276b

SHA1
b0e7b98cc1dbcaabb7a8ff7a00c82801feb45e89

SHA256
6164aac0cb06ac835119646484baeb139d42d320a8837ae044dcf61b95108a0e

SHA512
5b6990b20ee3a0228c04756978f1ac3e21a491e8ed0ac7353d452e17c481066a5a01d2d30f09f9353b84f1487baacb918b7a983ae2023afb257ccddc46b54b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\TJB44JZA.cookie

Filesize
541B

MD5
390965d570edf4f732ee7b1bd7070314

SHA1
792d7f43d0c05959071d3f3d60bbdddc8001bc4a

SHA256
9cda54eb284a89170841d97da24b42b81ee166d76b8a3082160665465f746a0e

SHA512
960cca25db5f82ed556fe4731a5f72d44b2d2d78a286cba913e512911928d840eac86869a3a4eabd969e455686bfc8d476e831ed85029a51d37080e2248d5983

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\u5fl9cze.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
6204883acce951fd3a4e3387a039798e

SHA1
dcb23f2e59ea9bef7256946d8cfaa75bc996fccf

SHA256
82f83db78c476eef86f0f0d34f1fbfbf16c59bb27e24d10b3c12cbeb874a0fc0

SHA512
319ae35acc5321e00e1787debf72fed87d6a62a5a2b7c98c76f9b9f2236cdb78d32710c4508af4e6b1cbc41b2d3ae2e17d0ae351a254f294eabb16932567e34c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\u5fl9cze.default-release\cache2\doomed\19757

Filesize
286KB

MD5
5e7e5606b0bd30ec86fd9c325d40ed25

SHA1
10ca83de15f293e08170c3be8d52d6764f57376a

SHA256
5f24210554784ee1c4854d136b78d0c02e38faaa5e06bc456b603a709771a0c6

SHA512
f538e4cd0e9785a75adf7b32b77e6ae7002adbc2495e31d518e0940ee6e64d90216164499ab7ed3ee4a180a88ce18aa8c620c63c87af67ede476331c0110cec0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\F4NRT9GN\warmup[1].gif

Filesize
43B

MD5
325472601571f31e1bf00674c368d335

SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\XVQWL0XX\www.bing[1].xml

Filesize
1KB

MD5
a033fb7550f496c8a959d8648b5f2cc2

SHA1
a7b4ee72cf3d7e9a6fa97b180b8fa614f3a104bc

SHA256
12d0c758516b786db7c7b4960b7fa0cefcf2b464c904f6ee2c79572210b8105d

SHA512
36100326355c13e139234a031c086a78e9bc0587d8a9de7a451aff47f933e7591348c04cb5f7ba7ea4716d67dac334bb48c6327ad96c4dbbd3cdd98b5a5becf0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\6CGVSTJ9.cookie

Filesize
101B

MD5
72f8fab4f16dc7f22202bbb6af9c4a7a

SHA1
6c987c2889b9870eda0918885b38a189eca97b3f

SHA256
9a31dac98d18405b6e85354053e266523063fd560ea48cbfd45c4b4b86036f8a

SHA512
f352f873e49e3688fa548548aad6b05ffe3a8a8f9543383b6d3074175064665185065c75d04476c8a589be151b8973072e5a7313ff733d70ec6a8e9e768297bb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\9TLE6D9M.cookie

Filesize
211B

MD5
55e5f219647cfbb5682f12eb7b506afd

SHA1
c4c3d31e083d58b8848ea9dacec722af603d268a

SHA256
bf783908d29c77fe8e21b193f46b515ad5bf079307cdf3b2442cac7e10978b0a

SHA512
76110cf23075506b52b4e55e577f870bb6299950ea56d4b119e7a7500ce39ca74aa754b78b53524e4de8dff18d9aa469107c6eff5bf4c5d40f3c84fe98ed97c7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\BO0E8MRF.cookie

Filesize
482B

MD5
255c142fc5319dbb31672e3398744763

SHA1
690af84f5ddd437971ff54328b0c0ce728179736

SHA256
aa7517c5bd0abb2a7bb27db948a322b0a4daf3ab824e906f9b07dfda395a6d38

SHA512
f57d3bd9d722541af029c6012572c91edfbfeebd470b1d4926d922fb02b455f60d4ccdbf4c63271fd475b0ce70fc057a85a40eb8b3ab8187cc8ca73afa03bc27

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\IYBXL1QE.cookie

Filesize
279B

MD5
5409590ecc8244792423fa4e1da3e199

SHA1
ac0478e37d9ca84e7199ad3e0eed23b7c0b42d46

SHA256
4d69c2ee8412736875672ce8afe659f66c585bda26d49b109af4a01e98962556

SHA512
c4ce627c02fba2292b8ee6879cfb0896ea850dda1d76e34ab36e8966671874bf55e5d6a02bd7ae1ccbb4aae02545743d456d4490dbf74f1f1b26f8e3db650168

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\Cookies\MBMA3KYN.cookie

Filesize
549B

MD5
4bf899c3d333d6b19759fa67d8cd6a24

SHA1
294c9ff3e929566ef85d9dbcb63ea307e4431c09

SHA256
cb3717f825d32ef8cee5e78500aa2d4e31d36029429e96114d52b06a78282b5d

SHA512
2c5f02d5d76e91af5fa7cb338aa8420c0b702445ecea69fe6f137e8a896137a0f7d89a3f5140089082b1dc51d02954559b56ae7d6274b4d8b4d860da752a80da

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\Cookies\SV1J0PFV.cookie

Filesize
515B

MD5
4e6f042405018e4dac2c210feb9f7779

SHA1
eb4323a1136161826982c3fbb5f68a5345eeb7d4

SHA256
1962d08f56dd363b7852320ee4b06223233d7934e009388ce7b7117cd5a16664

SHA512
e4bc7f35eaa71b65f5c83c266135fec62834eeca9f83483b4520e8562ed581cfede5a8d880524e116d26cce784c931eb3b60885401e42ca6959898988ca57bcd

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\Cookies\T8D1AGNF.cookie

Filesize
515B

MD5
795e1e946a9572a84847bb1f77ba6921

SHA1
7eb20202ccd9f47361e22e75246566bbc352991b

SHA256
3f14c5edddcf52b05219b3047a5c0743c03e988180a098229e0fd3c3e60909bb

SHA512
265678b63e7e1af523649b5e29e04cee1038b50d9c020b184f284af6e04448ce19a88d27105ccf0d63d657a6b2ccbfcbc9ffb0885081a4ed61d78c1bfb250735

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF7B9F37C554678640.TMP

Filesize
16KB

MD5
9ffcf967410609eab508f254e7ca6aa2

SHA1
061671a355104728137c16cdec077b7312545f36

SHA256
a3ec8754d1131e7e3f9e35a5ea52257b5cae7686f3f4355da048ac16f4a30e98

SHA512
11d215e25afe2eb70c54c54c6b4e3125382c842324889ffc15e1b9f0e333c04473e9a8eed6fbda0c09478693811ef46efe97a16d08209ef00496b98afd6b6973

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u5fl9cze.default-release\prefs-1.js

Filesize
6KB

MD5
d2fe59585c08ee2619fb77fcbb30892a

SHA1
9843733ed2505e032e6243b3ffdc433c562a75e6

SHA256
adcd0c4bb7369ae6014721781bc32a700c91b65ef2e5ef3ae6804655a2b92d83

SHA512
7f1ab5f9b47dade6d8d3fb28e32c4243fc6d83bea06fde30cb72fab85acdad382d0292a446f2414abd5e0ad8ec7e863465df9c0c4157eb1a8a0abe71bcb0ce6f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u5fl9cze.default-release\prefs-1.js

Filesize
7KB

MD5
9499a21d43c80a3023a3b15ad7e5d621

SHA1
842dd737f27e9b3f4bb094aeec39add6285a0fda

SHA256
d142f729eda51f252f086257d3d24eee6d9a939e1e53f0cc69e67930373bde3f

SHA512
4eab4c79af1214242e832642a93c226d95a2e8ede9c3c94f4f35836734487f7df63d31937c00698fe0c09cf6060e2904f9dde259c9bd7da384b1670b3fca26d6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u5fl9cze.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
578e79a00dd4a9cd167b861241d8c298

SHA1
cbe8ea938bc02ea5ad556df4671f2638ff5e3dc3

SHA256
d8b382e5327203e46212bed638e00758d02116e954e75fd2d9d95ba08a4569c6

SHA512
89d25c542cfcbe8d36613c3ca3ed275715d736efcf668d039df88a37018de1d1286ca236f5d3aa97c0ca82fd7d29cd854d194396bc238c2626831e5e875f9521

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u5fl9cze.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
84bd92f4faee0ff8ea143c71cbf4a210

SHA1
40705ae2128087c9f0ff9202e568b638b2af71e9

SHA256
3cab2ddfe7aed623b64774f9c844f2dd182672630bfb1e244c85ddff764eedf1

SHA512
bd49a0e9aba90dbeed8dc2785142678f5a683e5dee9dba3c37f0973489b85d21c93c3b0c68be4f7d4113b780e281148dada7fae2f8b619b5ef6aa4e8b2069889

Download Submit
memory/4116-144-0x000002E3CC4D0000-0x000002E3CC4D2000-memory.dmp

Filesize
8KB

Download
memory/4116-125-0x000002E3CC940000-0x000002E3CC950000-memory.dmp

Filesize
64KB

Download
memory/4116-109-0x000002E3CC120000-0x000002E3CC130000-memory.dmp

Filesize
64KB

Download
memory/5320-278-0x0000023156910000-0x0000023156912000-memory.dmp

Filesize
8KB

Download
memory/5320-280-0x00000231569D0000-0x00000231569D2000-memory.dmp

Filesize
8KB

Download
memory/5320-275-0x00000231568E0000-0x00000231568E2000-memory.dmp

Filesize
8KB

Download
memory/5532-218-0x000001D7BEE70000-0x000001D7BEE90000-memory.dmp

Filesize
128KB

Download
memory/5704-426-0x000001E5B7310000-0x000001E5B7312000-memory.dmp

Filesize
8KB

Download
memory/5704-438-0x000001E5BA510000-0x000001E5BA512000-memory.dmp

Filesize
8KB

Download
memory/5704-440-0x000001E5BA2C0000-0x000001E5BA2C2000-memory.dmp

Filesize
8KB

Download
memory/5704-432-0x000001E5B7A70000-0x000001E5B7A72000-memory.dmp

Filesize
8KB

Download
memory/5704-424-0x000001E5B7300000-0x000001E5B7302000-memory.dmp

Filesize
8KB

Download
memory/5704-338-0x000001E5B71D0000-0x000001E5B71D2000-memory.dmp

Filesize
8KB

Download
memory/5704-318-0x000001E5B6820000-0x000001E5B6840000-memory.dmp

Filesize
128KB

Download
memory/5704-436-0x000001E5BA4F0000-0x000001E5BA4F2000-memory.dmp

Filesize
8KB

Download
memory/5704-434-0x000001E5B90F0000-0x000001E5B90F2000-memory.dmp

Filesize
8KB

Download
memory/5704-430-0x000001E5B7360000-0x000001E5B7362000-memory.dmp

Filesize
8KB

Download