13735fe34c4fb1fc5efca9336215af08efaeca20859c61409f9fb7c7afc82332

Analysis

max time kernel
200s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2024, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
13735fe34c4fb1fc5efca9336215af08efaeca20859c61409f9fb7c7afc82332.exe
Size 2.5MB
Sample240102-231rgsecg3
SHA256 13735fe34c4fb1fc5efca9336215af08efaeca20859c61409f9fb7c7afc82332
MD5 c69b71ecaec8bacdde0a07eee4466271
SHA1 0fbe5ca5ad6ff5d8b40d9fa58fd9b27c61dc4576
SHA512 2d94a6224ffec7961462b77a95fb79d5ad4763f37448ca2fcfaed433080196cf5476738817ded087cdb171c76d68821f6fd741003525c8b393d4dac26b84bc19
SSDEEP 49152:/8e2YI7PLlQ72Rg8ldvgu+0DSt1kChO0hk381Hgy/PmWnqJlOyWif2GC:0rx767J6dvgu+4STs9yAe7OwyW2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4824	aq0CG06.exe
1400	KN3Hl33.exe
4848	2aC6943.exe
3340	5Kf6qz6.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	13735fe34c4fb1fc5efca9336215af08efaeca20859c61409f9fb7c7afc82332.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	aq0CG06.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	KN3Hl33.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000800000002320d-19.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

pid	Process
3340	5Kf6qz6.exe
3340	5Kf6qz6.exe
3340	5Kf6qz6.exe
3340	5Kf6qz6.exe
3340	5Kf6qz6.exe
3340	5Kf6qz6.exe
3340	5Kf6qz6.exe
3340	5Kf6qz6.exe
3340	5Kf6qz6.exe
3340	5Kf6qz6.exe
3340	5Kf6qz6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
4808	msedge.exe
4808	msedge.exe
2572	msedge.exe
2572	msedge.exe
5004	msedge.exe
5004	msedge.exe
1604	identity_helper.exe
1604	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
4848	2aC6943.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3340	5Kf6qz6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 4824	2080	13735fe34c4fb1fc5efca9336215af08efaeca20859c61409f9fb7c7afc82332.exe	93
PID 2080 wrote to memory of 4824	2080	13735fe34c4fb1fc5efca9336215af08efaeca20859c61409f9fb7c7afc82332.exe	93
PID 2080 wrote to memory of 4824	2080	13735fe34c4fb1fc5efca9336215af08efaeca20859c61409f9fb7c7afc82332.exe	93
PID 4824 wrote to memory of 1400	4824	aq0CG06.exe	94
PID 4824 wrote to memory of 1400	4824	aq0CG06.exe	94
PID 4824 wrote to memory of 1400	4824	aq0CG06.exe	94
PID 1400 wrote to memory of 4848	1400	KN3Hl33.exe	95
PID 1400 wrote to memory of 4848	1400	KN3Hl33.exe	95
PID 1400 wrote to memory of 4848	1400	KN3Hl33.exe	95
PID 4848 wrote to memory of 3956	4848	2aC6943.exe	96
PID 4848 wrote to memory of 3956	4848	2aC6943.exe	96
PID 3956 wrote to memory of 3164	3956	msedge.exe	99
PID 3956 wrote to memory of 3164	3956	msedge.exe	99
PID 4848 wrote to memory of 4836	4848	2aC6943.exe	100
PID 4848 wrote to memory of 4836	4848	2aC6943.exe	100
PID 4836 wrote to memory of 2936	4836	msedge.exe	101
PID 4836 wrote to memory of 2936	4836	msedge.exe	101
PID 4848 wrote to memory of 5004	4848	2aC6943.exe	102
PID 4848 wrote to memory of 5004	4848	2aC6943.exe	102
PID 5004 wrote to memory of 4508	5004	msedge.exe	103
PID 5004 wrote to memory of 4508	5004	msedge.exe	103
PID 1400 wrote to memory of 3340	1400	KN3Hl33.exe	104
PID 1400 wrote to memory of 3340	1400	KN3Hl33.exe	104
PID 1400 wrote to memory of 3340	1400	KN3Hl33.exe	104
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110
PID 4836 wrote to memory of 3708	4836	msedge.exe	110

C:\Users\Admin\AppData\Local\Temp\13735fe34c4fb1fc5efca9336215af08efaeca20859c61409f9fb7c7afc82332.exe
"C:\Users\Admin\AppData\Local\Temp\13735fe34c4fb1fc5efca9336215af08efaeca20859c61409f9fb7c7afc82332.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aq0CG06.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aq0CG06.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KN3Hl33.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KN3Hl33.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2aC6943.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2aC6943.exe
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3956
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffb9cec46f8,0x7ffb9cec4708,0x7ffb9cec4718
        6⤵
        
        PID:3164
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,16696080075230151506,6037380167683035205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4808
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16696080075230151506,6037380167683035205,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
        6⤵
        
        PID:5092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://facebook.com/login
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4836
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffb9cec46f8,0x7ffb9cec4708,0x7ffb9cec4718
        6⤵
        
        PID:2936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1468,14545728029052726642,5171253901976334875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5088
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1468,14545728029052726642,5171253901976334875,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
        6⤵
        
        PID:3708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:5004
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffb9cec46f8,0x7ffb9cec4708,0x7ffb9cec4718
        6⤵
        
        PID:4508
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1792,15074770832378535432,3715122434411025841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
        6⤵
        
        PID:4092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1792,15074770832378535432,3715122434411025841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2572
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,15074770832378535432,3715122434411025841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
        6⤵
        
        PID:808
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,15074770832378535432,3715122434411025841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
        6⤵
        
        PID:5044
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1792,15074770832378535432,3715122434411025841,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
        6⤵
        
        PID:4008
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,15074770832378535432,3715122434411025841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
        6⤵
        
        PID:5280
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,15074770832378535432,3715122434411025841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
        6⤵
        
        PID:5332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,15074770832378535432,3715122434411025841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
        6⤵
        
        PID:5456
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,15074770832378535432,3715122434411025841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
        6⤵
        
        PID:3332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,15074770832378535432,3715122434411025841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
        6⤵
        
        PID:884
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,15074770832378535432,3715122434411025841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
        6⤵
        
        PID:4956
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,15074770832378535432,3715122434411025841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
        6⤵
        
        PID:2436
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1792,15074770832378535432,3715122434411025841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
        6⤵
        
        PID:184
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1792,15074770832378535432,3715122434411025841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5Kf6qz6.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5Kf6qz6.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetWindowsHookEx
      PID:3340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

82a9a615-77fd-4651-92ed-d0cc9cca3472.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\82a9a615-77fd-4651-92ed-d0cc9cca3472.tmp
Size 2KB
SHA256 d662f984c46087dda2ccb70b4113021e3b02476746f8ab1d737bb1ee217a0b66
MD5 c14b9647c663d241485eacc8f69a42b5
SHA1 ae423bed8e45a1544451d1a833909386f6a42dfa
SHA512 474c3de584f3c549589b29ffa840ec9997aeb1c4dc0973e265912dfc1796a9e5b49869704efac62eb42dc190ead118debf084590ecc86968075a94229ae2a69e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b2c8e6719dba039dabcd8f27cd15466e7ba5335d2a87066129c7860b124d2ed3
MD5 59a60f67471b83691714b54bb462935c
SHA1 55de88c4d7d52fb2f5c9cb976d34fdc176174d83
SHA512 04a52ce294c128dc495031e376f3ccb84ccdee6f38e972e3f0d7a10e6db4edbad2381ec1d052759d756ac66761ca42524c83baaf2acfe731e510a022e40e27bf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 245b396ed1accfae337f770d3757c932bc30a8fc8dd133b5cefe82242760c2c7
MD5 fa070c9c9ab8d902ee4f3342d217275f
SHA1 ac69818312a7eba53586295c5b04eefeb5c73903
SHA512 df92ca6d405d603ef5f07dbf9516d9e11e1fdc13610bb59e6d4712e55dd661f756c8515fc2c359c1db6b8b126e7f5a15886e643d93c012ef34a11041e02cc0dc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 f794750a00de671288a8b6691dca0c1bad2020134a035ad6ea0ef06dafa32662
MD5 b0bb1b98756cf13f4828d67652ac40ec
SHA1 0d9d0c930ac63bc9ba3944c92d2bcec22e593815
SHA512 b964feb23410a246a642986b0a4d8a71508381168542df2f9f21fb517175e8eb900299cac499df10ba3470c8f8bc159536a95c7cb21cb442b61f8008ccc3cf54
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 0d0399072decf2a7a07a56ec03ddb54ed8b4d55900bc635a86ac09bde81a54b0
MD5 89f2c5d67b5bfd7afb9e137bbe0cb5af
SHA1 7a60f7892450e22cfafb1f3140ebff2750418ad5
SHA512 aefc7cf10aa7985b1b139169f46a2992dbd16271af52d61d6f6577cff1f3dc719584cec79364b81d4dc4cdc8436db8c5914e7fb92f592e9f0e6d208bd835cbcb
SSDEEP 96:nlk0A1SZvvwpvWMoiVmdeHUJJUWQyV+VDCzia:nlkhEtvGWMXIJrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 868646e8c6901c1da8ee1dbb9a03de7f3abc8c151814fca115c535336166f625
MD5 1f61ab05a687460cc07d3f5f05826d96
SHA1 5819143d21ddf3eb81face1a5d73b844299df446
SHA512 818aa70a4a9a3fd43c40b77a1b654b1da985cf64e40435971fcea3be4d2250b469f8554c4a10dd995d7c54d46e396dbeb556e87fa48d2ea7699cc8d4892b40e5
SSDEEP 96:nnk0A1SZvvwpMqQLWMoiVmdeAuE1wu81+lu51nqUJ1zUWQyV+VDCAiEwb:nnkhEtvLqQLWMQuEqu8cu5JqI1rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 01cac3630568c57c8b3316aa02e8b257c9b5b86678785bb3bad7d02184711811
MD5 23f06f5e7f3dc095c252492a7902acf9
SHA1 d57938796ae232365d01a557e3557650f572d9f9
SHA512 dd5ff81bc607e83351e763526bd28f9dde565be0de3f3835cf37059b2b6cb10d25e7e772fd680d9a4b0e64ed47639f1ed1af21bc317a33fe933ca076b0a468c6
SSDEEP 96:nnk0A1SJvvwpMqQLWMoiVmdeAuE1wu81+lu51nqUJizUWQyV+VD7AiEwb:nnkhEdvLqQLWMQuEqu8cu5JqISrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 cbde5ef09ab9e55e3efeb55448cd458d93a4ffd1dc3ae84df6a9aab8c9686295
MD5 3e4341260f88d416514456c46ff3b898
SHA1 71b781e217e24eda8d1dfa83b60b635ed98f78e5
SHA512 8138861a22158128ff091bfd33a4073c41c8d8eaccdaa98c6aab6943b4c456f1da6ab41de7893bb0b4d2c97c5af9f79ae2e0a63759164ac88e09194d70d2288e
SSDEEP 96:nlk0A1SZvvwpvWMoiVmdeHUJqzUWQyV+VDCzia:nlkhEtvGWMXI6rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 79aeb24861aac14cde024b60097f3c8c1e4f865d2027134c3efc63cd0dac890e
MD5 582c8b09c610bdd71714abd2b730fcce
SHA1 d725c5e68a096dc22f3755c9d1c8951b05263efd
SHA512 027c14fe38eb7e940882e2164efd1a28037232f92a1f922ef5e01c07c61983d32fd3f87064310eb17d1346291e25e3e063f967e7bae8e6176e64758f790352ea
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 3KB
SHA256 fca83da88b48121ce96092c629da0a0574d3c2fe77e3d9f6b1f3be3d0f227987
MD5 d10a654810779730ed51b56ad95a163b
SHA1 7896cd12ff7ef9fe5808041d66a7514248e97179
SHA512 678222a4c694e58ddb4a14cb2d03970972c6e9b536f4ea004a5881b0d0f2afeac1baa98cbe32b2b9dd42e4a7739244720fb61b4e4c36dac56414f8b61bd3ddda
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 4KB
SHA256 0c33c1fc3f86be13d24a1de27539f9f938154269afc36e9fdd82069c102eb872
MD5 5bbad2225c04bcc828f674cb2ce7ffe3
SHA1 c8f21fa62b7b19844ed0e45326ef8206660af723
SHA512 ab4c4f9a2e84dd2389f539d401335111264c9c8b41a696517f17f0f64fc0b3ee1597b1571a3486315f4469cda1431574429c11112861c801ab23e9764f952ad0
SSDEEP 96:iujLfH4P6EXih/cI9URXl8RotoeoTetxcv4E0SbBye43Pu:Fc8e2RUntvgbBB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 3KB
SHA256 6ee39ae11f660e99ad5cb57fb13d70446f4d2c71bff3d66ebc94efc4870ab20a
MD5 2de0615a8668973f1d7f4e98afca1a76
SHA1 73863f64fa4c8722ef20083d462d22d79cb26242
SHA512 3ce364402c53b397f8bfd015c0f29ba63c7f8ccaa18797d3c15ebf0717f6da9597d436aca8d8c6c34870c238b18365ccbb2de2f34fbb874f2e990233e3f4e490
MD5 SHA1 SHA512

Submit Download

aq0CG06.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aq0CG06.exe
Size 683KB
SHA256 c830bf2282a91d2c8c4909491d085ed29f556608caf019b25c08c26cb7dccd6a
MD5 4d2bd5b28a70a19acc1e71b715dc6e5b
SHA1 427d6e31504c3a5289d77206ece559f3bc7f2cce
SHA512 cbe3c520b5ff01be728352fadf44e619157f7b136bfc5bf9b4819876c66449f27c969adc36361aa12cbb125308bd15b122c36e1a31672076dd332e34d8d627f5
SSDEEP 12288:BMrUy90Ru1pKygeM6HbD/a5omzeY2Rg5KsNnaNysoQ0/du:xy8+pKfeM6HbD/a5oA2RgVgy7Qi0
MD5 SHA1 SHA512 SSDEEP

Submit Download

aq0CG06.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aq0CG06.exe
Size 796KB
SHA256 541476f700561deea8071f777cb01c7c301717915e966cd3aa8ff9800d8e3120
MD5 c76724874d95c83da9ee65db356e572d
SHA1 9b7d2e37c92f91550f32425b16d1dda717490eb6
SHA512 e1938f09bfeae523904476908acc9b0b9260e4c39907e3b530df72806e8aa131821f0f92844e61eb293ab8f8f9837801899876e63e26cf79d25b8b033529d4f1
SSDEEP 24576:xy8+pKfeM6HbD/a5oA2RgVgy7QiX80Z1FVRY:kBR7LYoA2RgV9tMg/Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

KN3Hl33.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KN3Hl33.exe
Size 950KB
SHA256 92d9e4fe21ef84df715a2cd47dc26c81a31aeb1cfdd0b570f44b751ae2868bc3
MD5 8d0f7d94062ef438c5cbeb7b34faf2bb
SHA1 bc434c76a83957a962558d70d9ea26c634e2b7a8
SHA512 6786bb3db219cfe710b1e3004dfe3d8cdfcbd37250f5c6de5f7569f5eb72d96ef844a32ca8f1b8470cc68e3e33e2ee776c81a3fc92371e4e86835f288a08b1a7
SSDEEP 24576:Ayd6FzD3L5o02R2cNyYBQI0ZmFVRqpmXSN:H05z1o02R2cFB3gwqQXSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

KN3Hl33.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KN3Hl33.exe
Size 1.1MB
SHA256 99fac270da10a3bca436a7499a1993e90e9445bb0c888270b8e7ffc08b6161a4
MD5 055531a740105ccbc77a191cb95d8e10
SHA1 4a5d69503ea302fe4d9e98a62d6ffdb590086bf0
SHA512 41356890d286e2356458c1eb363ec14ac25fcc4b0c78159a6adcb015a3c8b1eb0dcb6e4ae4d49112dc43bb95dc4335bcc92b60ec2cebe9094568e4484a6f18f7
SSDEEP 24576:Ayd6FzD3L5o02R2cNyYBQI0ZmFVRqpmXSIPxZmew+Gb:H05z1o02R2cFB3gwqQXSjewl
MD5 SHA1 SHA512 SSDEEP

Submit Download

2aC6943.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2aC6943.exe
Size 894KB
SHA256 0b343aceb8665dabb2f978310bc369bcac837bc19c7422d059fd485d50bb2c42
MD5 779db1fcaa2b01c67fa62fdcf541137c
SHA1 85aa8928790bc40c8dcfac0585e87526d285905b
SHA512 b657c28f2159a283214b8ad103492f467e79bbd6465385bde9f15e5c3712433e7d77bf08b5637c2d4dcd7c2fa85fe4704ce0cf4096af4097861762fe10f5a00f
SSDEEP 12288:5qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTT:5qDEvCTbMWu7rQYlBQcBiT6rprG8asT
MD5 SHA1 SHA512 SSDEEP

Submit Download

5Kf6qz6.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5Kf6qz6.exe
Size 1.5MB
SHA256 d7dd9ecebcbb7f231089d5f387682120d46a895b652f5a9c6ee663b1922fa8b4
MD5 5029a0767b3bb36cd7105e83778330ea
SHA1 83d56d1f28cf29b87e26917bf17b70edeef7724a
SHA512 c2872608b20a7b53414573c30317f1c0bca3ab4e69dd47b21900b63e7b2691c65278d03504314ff4043a33eed5bfe36cff8be13b771a5115bb6aac1691e837ed
SSDEEP 24576:Ac20ZgFVRNpI8INxPANOQeFg/KhRRUf/wThgXJyMDPp1eTmbCJSy:AbgeNK8fXeFg/BZPD6IC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3340-43-0x0000000000920000-0x0000000000D7E000-memory.dmp

Download

memory/3340-137-0x0000000000920000-0x0000000000D7E000-memory.dmp

Download

memory/3340-134-0x0000000000920000-0x0000000000D7E000-memory.dmp

Download

memory/3340-164-0x0000000000920000-0x0000000000D7E000-memory.dmp

Download

memory/3340-168-0x0000000000920000-0x0000000000D7E000-memory.dmp

Download

memory/3340-111-0x0000000000920000-0x0000000000D7E000-memory.dmp

Download

memory/3340-191-0x0000000000920000-0x0000000000D7E000-memory.dmp

Download

memory/3340-89-0x0000000000920000-0x0000000000D7E000-memory.dmp

Download

memory/3340-203-0x0000000000920000-0x0000000000D7E000-memory.dmp

Download

memory/3340-74-0x0000000000920000-0x0000000000D7E000-memory.dmp

Download

memory/3340-66-0x0000000000920000-0x0000000000D7E000-memory.dmp

Download

memory/3340-219-0x0000000000920000-0x0000000000D7E000-memory.dmp

Download

memory/3340-63-0x0000000000920000-0x0000000000D7E000-memory.dmp

Download