436e3125f8840c8c43e3cdfa53051665ed66ac98f24196c642581931a69e1325

Analysis

max time kernel
146s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21645cb838b440ce773eeefa8647b7c9.exe
Size

62KB
MD5

21645cb838b440ce773eeefa8647b7c9
SHA1

6b071aef7cf04c1965aee31897da4d3e448976b7
SHA256

436e3125f8840c8c43e3cdfa53051665ed66ac98f24196c642581931a69e1325
SHA512

39fa6a39e14d8db89eec495d57e3b74a9511aef8f686d74f3ecb411ec622a60b7ce74230f91d8f6c6c15ed50dc70350083a069f89be1b052a3bd5c36431b740c
SSDEEP

1536:/fjQtATi+FDfXsKA2p2v97RybohyjWgX5PtXhSMImX8/nlE:/fkaFTjMtRyDjR5PtVXGi

Score

7^/10

adware stealer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	21645cb838b440ce773eeefa8647b7c9.exe

Loads dropped DLL 1 IoCs

pid	Process
1340	regsvr32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1280-0-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/memory/1280-20-0x0000000000400000-0x0000000000430000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{93811B7D-621D-4230-A7D2-851BF93CBBAF}	regsvr32.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gzo.dll	21645cb838b440ce773eeefa8647b7c9.exe
File created	C:\Windows\SysWOW64\p.ico	21645cb838b440ce773eeefa8647b7c9.exe
File created	C:\Windows\SysWOW64\c.ico	21645cb838b440ce773eeefa8647b7c9.exe
File created	C:\Windows\SysWOW64\m.ico	21645cb838b440ce773eeefa8647b7c9.exe
File created	C:\Windows\SysWOW64\s.ico	21645cb838b440ce773eeefa8647b7c9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 60 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93811B7D-621D-4230-A7D2-851BF93CBBAF}\ = "LopeNinja"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06580F31-744D-453A-A497-EF2D87F78204}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06580F31-744D-453A-A497-EF2D87F78204}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06580F31-744D-453A-A497-EF2D87F78204}\ = "Imsj3dz"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\gzo.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62C07DC1-5562-4C19-9060-35144090CA70}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{62C07DC1-5562-4C19-9060-35144090CA70}\ = "_Imsj3dzEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93811B7D-621D-4230-A7D2-851BF93CBBAF}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93811B7D-621D-4230-A7D2-851BF93CBBAF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{62C07DC1-5562-4C19-9060-35144090CA70}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06580F31-744D-453A-A497-EF2D87F78204}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93811B7D-621D-4230-A7D2-851BF93CBBAF}\VersionIndependentProgID\ = "Lnmd7s"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62C07DC1-5562-4C19-9060-35144090CA70}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Lnmd7s\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93811B7D-621D-4230-A7D2-851BF93CBBAF}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06580F31-744D-453A-A497-EF2D87F78204}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06580F31-744D-453A-A497-EF2D87F78204}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06580F31-744D-453A-A497-EF2D87F78204}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06580F31-744D-453A-A497-EF2D87F78204}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\ = "gh3fcv Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{62C07DC1-5562-4C19-9060-35144090CA70}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06580F31-744D-453A-A497-EF2D87F78204}\ = "Imsj3dz"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06580F31-744D-453A-A497-EF2D87F78204}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06580F31-744D-453A-A497-EF2D87F78204}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Lnmd7s.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Lnmd7s\CurVer\ = "Lnmd7s.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93811B7D-621D-4230-A7D2-851BF93CBBAF}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93811B7D-621D-4230-A7D2-851BF93CBBAF}\ProgID\ = "Lnmd7s.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62C07DC1-5562-4C19-9060-35144090CA70}\ = "_Imsj3dzEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93811B7D-621D-4230-A7D2-851BF93CBBAF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62C07DC1-5562-4C19-9060-35144090CA70}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06580F31-744D-453A-A497-EF2D87F78204}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06580F31-744D-453A-A497-EF2D87F78204}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Lnmd7s\ = "LopeNinja"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93811B7D-621D-4230-A7D2-851BF93CBBAF}\InprocServer32\ = "C:\\Windows\\SysWow64\\gzo.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{62C07DC1-5562-4C19-9060-35144090CA70}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Lnmd7s.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62C07DC1-5562-4C19-9060-35144090CA70}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Lnmd7s.1\ = "LopeNinja"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Lnmd7s	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62C07DC1-5562-4C19-9060-35144090CA70}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{62C07DC1-5562-4C19-9060-35144090CA70}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Lnmd7s.1\CLSID\ = "{93811B7D-621D-4230-A7D2-851BF93CBBAF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Lnmd7s\CLSID\ = "{93811B7D-621D-4230-A7D2-851BF93CBBAF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Lnmd7s\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06580F31-744D-453A-A497-EF2D87F78204}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93811B7D-621D-4230-A7D2-851BF93CBBAF}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93811B7D-621D-4230-A7D2-851BF93CBBAF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62C07DC1-5562-4C19-9060-35144090CA70}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{62C07DC1-5562-4C19-9060-35144090CA70}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93811B7D-621D-4230-A7D2-851BF93CBBAF}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{62C07DC1-5562-4C19-9060-35144090CA70}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
5440	msedge.exe
5440	msedge.exe
1744	identity_helper.exe
1744	identity_helper.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 1340	1280	21645cb838b440ce773eeefa8647b7c9.exe	24
PID 1280 wrote to memory of 1340	1280	21645cb838b440ce773eeefa8647b7c9.exe	24
PID 1280 wrote to memory of 1340	1280	21645cb838b440ce773eeefa8647b7c9.exe	24
PID 1280 wrote to memory of 5440	1280	21645cb838b440ce773eeefa8647b7c9.exe	44
PID 1280 wrote to memory of 5440	1280	21645cb838b440ce773eeefa8647b7c9.exe	44
PID 5440 wrote to memory of 4620	5440	msedge.exe	43
PID 5440 wrote to memory of 4620	5440	msedge.exe	43
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 4636	5440	msedge.exe	56
PID 5440 wrote to memory of 1648	5440	msedge.exe	53
PID 5440 wrote to memory of 1648	5440	msedge.exe	53
PID 5440 wrote to memory of 2312	5440	msedge.exe	52
PID 5440 wrote to memory of 2312	5440	msedge.exe	52
PID 5440 wrote to memory of 2312	5440	msedge.exe	52
PID 5440 wrote to memory of 2312	5440	msedge.exe	52
PID 5440 wrote to memory of 2312	5440	msedge.exe	52
PID 5440 wrote to memory of 2312	5440	msedge.exe	52
PID 5440 wrote to memory of 2312	5440	msedge.exe	52
PID 5440 wrote to memory of 2312	5440	msedge.exe	52
PID 5440 wrote to memory of 2312	5440	msedge.exe	52
PID 5440 wrote to memory of 2312	5440	msedge.exe	52
PID 5440 wrote to memory of 2312	5440	msedge.exe	52
PID 5440 wrote to memory of 2312	5440	msedge.exe	52
PID 5440 wrote to memory of 2312	5440	msedge.exe	52
PID 5440 wrote to memory of 2312	5440	msedge.exe	52
PID 5440 wrote to memory of 2312	5440	msedge.exe	52

C:\Users\Admin\AppData\Local\Temp\21645cb838b440ce773eeefa8647b7c9.exe
"C:\Users\Admin\AppData\Local\Temp\21645cb838b440ce773eeefa8647b7c9.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\gzo.dll
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://lookfornewsoftware.com/bind2.php?id=3913627
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8775459433043972239,15272676600463961948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:5652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8775459433043972239,15272676600463961948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,8775459433043972239,15272676600463961948,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,8775459433043972239,15272676600463961948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8775459433043972239,15272676600463961948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,8775459433043972239,15272676600463961948,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8775459433043972239,15272676600463961948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:1
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,8775459433043972239,15272676600463961948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,8775459433043972239,15272676600463961948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8775459433043972239,15272676600463961948,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8775459433043972239,15272676600463961948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8775459433043972239,15272676600463961948,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8775459433043972239,15272676600463961948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8775459433043972239,15272676600463961948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1880 /prefetch:1
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8775459433043972239,15272676600463961948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,8775459433043972239,15272676600463961948,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5392 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7e6646f8,0x7ffe7e664708,0x7ffe7e664718
1⤵
PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1386433ecc349475d39fb1e4f9e149a0

SHA1
f04f71ac77cb30f1d04fd16d42852322a8b2680f

SHA256
a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc

SHA512
fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9c59aa765bcaabbfbfec693ba38e6c47

SHA1
b858e89586c5242b1a0fe9731857b85124bfd2f2

SHA256
f640529b990dc3b6e27bf442b5245ba4eac2959fcf652dfaeed0a1ab89083f2f

SHA512
ae2db94990b722c251cdf78698ed5f6c3417e2931b1c5d1fea5ed4d8768bd8abdb4712449383f979e3c704b4a3182a26bfcfb2173442ac31f2dc2f50e4631cbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e664066e3aa135f185ed1c194b9fa1f8

SHA1
358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

SHA256
86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

SHA512
58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b6c948b6-2911-4dbf-8034-a6b755ae772b.tmp

Filesize
5KB

MD5
b1da05b796fc7a814540dd21eaed34b9

SHA1
46ece089017af833ecf98ce6eef926ffa5b2e07f

SHA256
39f4bd3add2a696e9f485fa51312358f3ae5aa0a10b85efbddc7354588519ecf

SHA512
86c0f69349229518314caf3ea7fc300a40163e8bfebf7a0bdfdbecc978e87b9bed2c7f66ebc03cd63010d74b53c2cef7522a08595675dd11cd07fe2604c97720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ef08bfb206e58f5cd9acda6e468ce9b2

SHA1
c38e15ecf53dc512e379f743fcd51f17891c1456

SHA256
d2d8b622af084f8120d6714b5865d13b3467af22dd104a197af49fa7528db6d2

SHA512
29aead0198e34c776c6e4b713f834ec01b9eb0737283c3f8a71e4b385fe3c4a303d42eaa4d60939868a840bc7c978c44633620b22d60b614d3f6007564191cbd

Download Submit
C:\Windows\SysWOW64\gzo.dll

Filesize
100KB

MD5
40a74d1905b006595e64d5b5bc02e222

SHA1
1cb951eaf7d4d84c2aace11223c9b8703ae633ef

SHA256
7b8997a4e1b6d8148b0d37e4f0d2d108328c81622cbf2180554081575257bedf

SHA512
61ae18e334f9e5d299f6421f1c74525e4f037ac66daf780de9263882626dec767ae61ec03d0be8a24d8f10980e7d2d341253b32c75ff37b03d24f696bbe63205

Download Submit
memory/1280-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1280-20-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download