5767724a51f17b238a1430ce22810473ce1eb1cb2211a6f356c51ee143b3ec8f

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04c124d16ae427d67e2805c62c7c2b39.exe
Size

32KB
MD5

04c124d16ae427d67e2805c62c7c2b39
SHA1

3389d1548f4508c087a0b9def501ff801332a97d
SHA256

5767724a51f17b238a1430ce22810473ce1eb1cb2211a6f356c51ee143b3ec8f
SHA512

954315427a4360cfb4dcb2c8baa5f48b1804a55c9d7e1f9ccf67537c73d2965dd35574c47ba787dfa74ad6a805ba07ca7a7e05e0102d34fac6a91dcbb4882338
SSDEEP

384:GTe/OmxDM6AbQBw+8tWp3WrGQ6mXjDBRJwGaRLlvn:ae2mxDMBbQB97SGQrXj1POR

Score

8^/10

upx

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\drivers\afunix.sys	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\drivers\gm.dls	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\drivers\gmreadme.txt	04c124d16ae427d67e2805c62c7c2b39.exe

Manipulates Digital Signatures 1 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\wintrust.dll	04c124d16ae427d67e2805c62c7c2b39.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	04c124d16ae427d67e2805c62c7c2b39.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3440-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/3440-10-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000100000001da9f-15.dat	upx
behavioral2/memory/3440-21-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/3440-25-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/3440-27-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/3440-81-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/3440-113-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/3440-133-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/3440-141-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/3440-266-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/3440-416-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/3440-571-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\WinMsoIrmProtector.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\wscproxystub.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\efsadu.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\grb.rs	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\mobsync.exe	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\gpapi.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\UevCustomActionTypes.tlb	04c124d16ae427d67e2805c62c7c2b39.exe
File opened for modification	C:\WINDOWS\SysWOW64\mfc140kor.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\HdcpHandler.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\KBDSYR2.DLL	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\msexch40.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File opened for modification	C:\WINDOWS\SysWOW64\msvcp140_2.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\TrustedSignalCredProv.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\@AppHelpToast.png	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\ddrawex.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\LocationFrameworkPS.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\lodctr.exe	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\Windows.ApplicationModel.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\winmmbase.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\xmlfilter.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\ctl3d32.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\fdWSD.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\gpscript.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\lcptr.tbl	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\msls31.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\NetSetupApi.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\odbcjt32.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\windows.internal.shellcommon.TokenBrokerModal.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\esevss.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\Windows.Media.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\dmiso8601utils.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\MSAMRNBSink.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\msdtcprx.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\useractivitybroker.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\userinitext.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\wdscore.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\colorcpl.exe	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\backgroundTaskHost.exe	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\ContentDeliveryManager.Utilities.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\dsauth.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\gpupdate.exe	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\MuiUnattend.exe	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\Phoneutil.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\SimAuth.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\12520850.cpx	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\SyncRes.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\KBDTIPRD.DLL	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\msimg32.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\scecli.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File opened for modification	C:\WINDOWS\SysWOW64\vcomp110.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\KBDKURD.DLL	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\locale.nls	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\perfmon.msc	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\pku2u.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\recover.exe	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\WinSCard.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\wlanui.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\capiprovider.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\AUDIOKSE.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\dsrole.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\KBDHELA2.DLL	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\SysWOW64\msscript.ocx	04c124d16ae427d67e2805c62c7c2b39.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\WINDOWS\bfsvc.exe	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\hh.exe	04c124d16ae427d67e2805c62c7c2b39.exe
File opened for modification	C:\WINDOWS\lsasetup.log	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\mib.bin	04c124d16ae427d67e2805c62c7c2b39.exe
File opened for modification	C:\WINDOWS\PFRO.log	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\winhlp32.exe	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\WMSysPr9.prx	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\splwow64.exe	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\sysmon.exe	04c124d16ae427d67e2805c62c7c2b39.exe
File opened for modification	C:\WINDOWS\system.ini	04c124d16ae427d67e2805c62c7c2b39.exe
File opened for modification	C:\WINDOWS\DtcInstall.log	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\explorer.exe	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\HelpPane.exe	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\notepad.exe	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\twain_32.dll	04c124d16ae427d67e2805c62c7c2b39.exe
File opened for modification	C:\WINDOWS\win.ini	04c124d16ae427d67e2805c62c7c2b39.exe
File opened for modification	C:\WINDOWS\WindowsUpdate.log	04c124d16ae427d67e2805c62c7c2b39.exe
File opened for modification	C:\WINDOWS\Professional.xml	04c124d16ae427d67e2805c62c7c2b39.exe
File opened for modification	C:\WINDOWS\setupact.log	04c124d16ae427d67e2805c62c7c2b39.exe
File opened for modification	C:\WINDOWS\setuperr.log	04c124d16ae427d67e2805c62c7c2b39.exe
File opened for modification	C:\WINDOWS\SysmonDrv.sys	04c124d16ae427d67e2805c62c7c2b39.exe
File created	C:\WINDOWS\write.exe	04c124d16ae427d67e2805c62c7c2b39.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1636	msedge.exe
1636	msedge.exe
1536	identity_helper.exe
1536	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 1636	3440	04c124d16ae427d67e2805c62c7c2b39.exe	104
PID 3440 wrote to memory of 1636	3440	04c124d16ae427d67e2805c62c7c2b39.exe	104
PID 1636 wrote to memory of 4232	1636	msedge.exe	105
PID 1636 wrote to memory of 4232	1636	msedge.exe	105
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 4768	1636	msedge.exe	107
PID 1636 wrote to memory of 1420	1636	msedge.exe	106
PID 1636 wrote to memory of 1420	1636	msedge.exe	106
PID 1636 wrote to memory of 4440	1636	msedge.exe	108
PID 1636 wrote to memory of 4440	1636	msedge.exe	108
PID 1636 wrote to memory of 4440	1636	msedge.exe	108
PID 1636 wrote to memory of 4440	1636	msedge.exe	108
PID 1636 wrote to memory of 4440	1636	msedge.exe	108
PID 1636 wrote to memory of 4440	1636	msedge.exe	108
PID 1636 wrote to memory of 4440	1636	msedge.exe	108
PID 1636 wrote to memory of 4440	1636	msedge.exe	108
PID 1636 wrote to memory of 4440	1636	msedge.exe	108
PID 1636 wrote to memory of 4440	1636	msedge.exe	108
PID 1636 wrote to memory of 4440	1636	msedge.exe	108
PID 1636 wrote to memory of 4440	1636	msedge.exe	108
PID 1636 wrote to memory of 4440	1636	msedge.exe	108
PID 1636 wrote to memory of 4440	1636	msedge.exe	108
PID 1636 wrote to memory of 4440	1636	msedge.exe	108
PID 1636 wrote to memory of 4440	1636	msedge.exe	108
PID 1636 wrote to memory of 4440	1636	msedge.exe	108
PID 1636 wrote to memory of 4440	1636	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\04c124d16ae427d67e2805c62c7c2b39.exe
"C:\Users\Admin\AppData\Local\Temp\04c124d16ae427d67e2805c62c7c2b39.exe"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.freeav.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7fff337b46f8,0x7fff337b4708,0x7fff337b4718
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2256,17188882959451257479,8113550262528620333,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,17188882959451257479,8113550262528620333,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2256,17188882959451257479,8113550262528620333,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,17188882959451257479,8113550262528620333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
    3⤵
    PID:336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,17188882959451257479,8113550262528620333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,17188882959451257479,8113550262528620333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,17188882959451257479,8113550262528620333,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
    3⤵
    PID:772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,17188882959451257479,8113550262528620333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,17188882959451257479,8113550262528620333,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,17188882959451257479,8113550262528620333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1
    3⤵
    PID:1416
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,17188882959451257479,8113550262528620333,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6372 /prefetch:8
    3⤵
    PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,17188882959451257479,8113550262528620333,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6372 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,17188882959451257479,8113550262528620333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1708 /prefetch:1
    3⤵
    PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,17188882959451257479,8113550262528620333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,17188882959451257479,8113550262528620333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,17188882959451257479,8113550262528620333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
    3⤵
    PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.antispyware.com/
  2⤵
  PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff337b46f8,0x7fff337b4708,0x7fff337b4718
    3⤵
    PID:2828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
011193d03a2492ca44f9a78bdfb8caa5

SHA1
71c9ead344657b55b635898851385b5de45c7604

SHA256
d21f642fdbc0f194081ffdd6a3d51b2781daef229ae6ba54c336156825b247a0

SHA512
239c7d603721c694b7902996ba576c9d56acddca4e2e7bbe500039d26d0c6edafbbdc2d9f326f01d71e162872d6ff3247366481828e0659703507878ed3dd210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ddd74c4844ca0e867e6fac7ac315c736

SHA1
6070cefdd296d898dcb4c7e2e8cee5eb34f9a132

SHA256
4ea0a85cbf2a53302461b04ff153be7c42015143b1bbcb4aa27b2c0b3e36ed5d

SHA512
70c9acf997168607d1012d04cff689f33a3feddfb120691b5ff14d75d90913dc3ac74e57d05b08ee461a9cf01c8c0272c5d5758d3bbc5414d2b9d06e2a13bc0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2007b8c697c3ade65df897c8c737e4c0

SHA1
d813af759c4a0198af59b9b75a45970af17d647e

SHA256
9ff33e23a722d82c72b4482d02fd7fdb4048d3bec6c247e42560914dd4ab1aef

SHA512
89611d67033939371d58d390bdb60ae64348278087f6a044579c84449015ad7c81eebfbf00a344c80682141b165106cc4d254a1c7315056c152321d0ac18ebb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ef4f0a6526241d3a39e3878dfd71cbc1

SHA1
f8dbc19ff2544f7dc74d8b10ecaaae89d5bea593

SHA256
a4338e940bafbedaf19abec8f05fa64bc040f8cf9ff653fb447b006146e4da2e

SHA512
e36a0c81844adedf91484067e32da8bb1d203a20cf1d62d4f0eb8fb9be02b770e150c69ccb951121a8217193f22255770645e358f2a3925ab88b63e1722247a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
176e4fa8c848d28a208cbd63f70dbd1e

SHA1
a04d73e08807d8d6655c62872ff22cde0e573f1e

SHA256
ddc219bff4c168b6959b12f5044d7401e425166bdedb3846fd4dd6bff03ef20d

SHA512
33dbc4a22636fb8d799669eeaa0e41a6abfc48bee56799fc8a9cb04ae20284e123db95e571d2df0dda74e56c0b4eb93d309057109566a9354526ec5a65c3ca06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
3b953b130c3436ec6ffe2249866fccf2

SHA1
ec4a3f26aef36c31d06cd23305425a85573a5d36

SHA256
ccbc1404628c58afbcfa4058c9a7e62fe5c086ff6fd09ca9e25cc177ebab52d6

SHA512
ca7b0bd133de7528eba9f05651c1bd8ca099022de7ca08a9e0af54d8477c484e9167731b09220b433aba3c8368de33b8ce3fcc78422deaabeec25babc6124b8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
81b32e40a043e33789e8c5b19720ab75

SHA1
5de19b9304e5429896ac4504376735f8a4e81239

SHA256
606aa1f74f226054a341a5d5760a5f05bd4bd0a0a351c25f5a845059c26633c6

SHA512
dd0f5cebe36bf0683c8e4bd9c356faa3be05d38a1280de11e18ad8d27a4b2468da46bd95f584590491a30eeb78ce155fe8fca9f608b3278f40ef31a3305fe821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
5KB

MD5
9f747cf24ca6296973df9710d25d4116

SHA1
d5f6eca3b0903e35dcc4cfc235cdd35d122314fa

SHA256
b47a35d94fb85bb70cb9c3abf3a45211d65c6fdc22382b1f4dec3ed83d509730

SHA512
0833efe8442a9debd53f4df2732d3c51e8e7b5316cd3af8ce3a0726f326584a15b275e4d53edef72acfaf54321dafe34df031f1e5d37aa676b0c35ea2a344884

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
20c4c0c239de1630888608f3d8de46f6

SHA1
9a23c754bc56b5567a3bd0343889d17261d29b4a

SHA256
7c99fc4813f5c83b1819dcbb0d4580c95ef402938394b4e5f6620e75739b1678

SHA512
cf99ddf17cfba1cae5ee13b56dc498b0b10df1f1fd40caefa93ed96672ffc2175ea4e2a7fd3b906fd6d232cda9dcb0beaeef3790f389d1eb94753ad7b7ae950d

Download Submit
C:\Windows\setupact.log

Filesize
29KB

MD5
8102e9e6a222589bad7e078948af746d

SHA1
4ef3f8bb63a924fc8c7c4cce52962f8a3743b155

SHA256
1932196c3c2a45af9bcd4176353ec3d26b91d7f79f61f39e2352b6c2a8b869f6

SHA512
1878f1bffe8377cd05a43614dcffc4a689590e588a905d110ea2fb31ddca0db6fc7cb1304ae6c0141407d58971cbfa4b60b7397de2b18423cee25e29b3ba2c1b

Download Submit
C:\exc.exe

Filesize
4KB

MD5
6217ccd824a71b86735bbe29d85553af

SHA1
e1e4624ed9b30780a010aa390fca529de80bd77f

SHA256
43b927d2d254f0400f241914ec684745735b6f4f7dab87fafc97355943edcc0b

SHA512
68525eb956bf95b7c5dd86bfee29e2d617978f5c0ce1be8f1baf49d9154aea17e8115a6f5ab101ec611c03dff7fdcd3917cbcc3976061f2563bec4bda3623a86

Download Submit
memory/3440-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3440-266-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3440-21-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3440-133-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3440-141-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3440-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3440-113-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3440-81-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3440-416-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3440-571-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3440-27-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3440-25-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download