kinsing | 300fe6224578b1254a43444f7e1783dd608a6c065d4e6089e7560e719fc787b2

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

qqa02_u88setup.exe
Size

52KB
MD5

12c1ff63ec91a8171528a56d4d4c2b8a
SHA1

9001f9552a7fede019c2c442e1db7f6e8646bc95
SHA256

684e89322a208eac8469d6c2bc6d359dcd9d3f9ce256f336fe5bfbdb944bb2c4
SHA512

ab3a0e108a1ca87b8c1e629c7f6a8c415b98e8fe5f6a64d7a32d95b524b04e016ae850efe4715e063a047abd347925ef0e9c63c746ccbd151107131e0fbc5633
SSDEEP

768:qBzvOHcki1zN3Vl5g/zg70md3fAvTcNvQ+cAnviOPaWyRI5VvCzfaXhWIQsNi:6vpkivUxmd3fuXu5yWyW5RBXb

Score

10^/10

kinsing loader persistence

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Drops file in Drivers directory 1 IoCs

Processes:

U88.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts U88.exe
Executes dropped EXE 1 IoCs

Processes:

U88.exe

pid process

1868 U88.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	U88.exe

pid	process
1868	U88.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

qqa02_u88setup.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\update8 = "c:\\program Files\\Internet explorer\\lib\\aupdate.exe"	qqa02_u88setup.exe

Drops file in Program Files directory 17 IoCs

Processes:

qqa02_u88setup.exe

description	ioc	process
File created	C:\Program Files\Internet Explorer\lib\setup.tmp	qqa02_u88setup.exe
File created	C:\Program Files\Internet Explorer\lib\allverx.dat	qqa02_u88setup.exe
File created	C:\Program Files\Internet Explorer\lib\u88.exe	qqa02_u88setup.exe
File created	C:\Program Files\Internet Explorer\lib\libu88icon.Ico.tmp	qqa02_u88setup.exe
File created	C:\Program Files\Internet Explorer\lib\u88icon.Ico	qqa02_u88setup.exe
File opened for modification	C:\Program Files\Internet Explorer\lib\libu88icon.Ico	qqa02_u88setup.exe
File created	C:\Program Files\Internet Explorer\lib\update.dat	qqa02_u88setup.exe
File opened for modification	C:\Program Files\Internet Explorer\lib\libupdate.dat	qqa02_u88setup.exe
File created	C:\Program Files\Internet Explorer\lib\liballverx.dat.tmp	qqa02_u88setup.exe
File created	C:\Program Files\Internet Explorer\lib\aupdate.exe	qqa02_u88setup.exe
File created	C:\Program Files\Internet Explorer\lib\libu88.exe.tmp	qqa02_u88setup.exe
File opened for modification	C:\Program Files\Internet Explorer\lib\libu88.exe	qqa02_u88setup.exe
File created	C:\Program Files\Internet Explorer\lib\libaupdate.exe.tmp	qqa02_u88setup.exe
File opened for modification	C:\Program Files\Internet Explorer\lib\liballverx.dat	qqa02_u88setup.exe
File opened for modification	C:\Program Files\Internet Explorer\lib\libaupdate.exe	qqa02_u88setup.exe
File created	C:\Program Files\Internet Explorer\lib\libupdate.dat.tmp	qqa02_u88setup.exe
File created	C:\Program Files\Internet Explorer\lib\lib	qqa02_u88setup.exe

Drops file in Windows directory 1 IoCs

Processes:

U88.exe

description ioc process

File created C:\Windows\u88icon.ico U88.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\u88icon.ico	U88.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3676	msedge.exe
3676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4476	identity_helper.exe
4476	identity_helper.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

qqa02_u88setup.exe

pid process

4756 qqa02_u88setup.exe

pid	process
4756	qqa02_u88setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

qqa02_u88setup.exeexplorer.exemsedge.exe

description	pid	process	target process
PID 4756 wrote to memory of 1868	4756	qqa02_u88setup.exe	U88.exe
PID 4756 wrote to memory of 1868	4756	qqa02_u88setup.exe	U88.exe
PID 4756 wrote to memory of 1868	4756	qqa02_u88setup.exe	U88.exe
PID 4756 wrote to memory of 3556	4756	qqa02_u88setup.exe	explorer.exe
PID 4756 wrote to memory of 3556	4756	qqa02_u88setup.exe	explorer.exe
PID 4756 wrote to memory of 3556	4756	qqa02_u88setup.exe	explorer.exe
PID 1952 wrote to memory of 4676	1952	explorer.exe	msedge.exe
PID 1952 wrote to memory of 4676	1952	explorer.exe	msedge.exe
PID 4676 wrote to memory of 404	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 404	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3156	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3676	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 3676	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1892	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1892	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1892	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1892	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1892	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1892	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1892	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1892	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1892	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1892	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1892	4676	msedge.exe	msedge.exe
PID 4676 wrote to memory of 1892	4676	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\qqa02_u88setup.exe
"C:\Users\Admin\AppData\Local\Temp\qqa02_u88setup.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756

C:\Program Files\Internet Explorer\lib\U88.exe
"C:\Program Files\Internet Explorer\lib\U88.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
PID:1868

C:\Windows\SysWOW64\explorer.exe
explorer http://down.u88.cn/qqa02/u88newqqa02.asp
2⤵
PID:3556

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://down.u88.cn/qqa02/u88newqqa02.asp
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa21ed46f8,0x7ffa21ed4708,0x7ffa21ed4718
3⤵
PID:404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,7202436860440451486,9545551521464484568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,7202436860440451486,9545551521464484568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
3⤵
PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7202436860440451486,9545551521464484568,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
3⤵
PID:3156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7202436860440451486,9545551521464484568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
3⤵
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7202436860440451486,9545551521464484568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
3⤵
PID:1776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7202436860440451486,9545551521464484568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
3⤵
PID:1268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7202436860440451486,9545551521464484568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
3⤵
PID:2976

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7202436860440451486,9545551521464484568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
3⤵
PID:460

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7202436860440451486,9545551521464484568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7202436860440451486,9545551521464484568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
3⤵
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7202436860440451486,9545551521464484568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
3⤵
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7202436860440451486,9545551521464484568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
3⤵
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7202436860440451486,9545551521464484568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
3⤵
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7202436860440451486,9545551521464484568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1876 /prefetch:1
3⤵
PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7202436860440451486,9545551521464484568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1
3⤵
PID:2428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7202436860440451486,9545551521464484568,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4624 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Internet Explorer\lib\u88.exe
Filesize
44KB

MD5
c9246c85265ce6e0dd271aaa77d82a50

SHA1
bbc1231c67b80dee1d786beebee2bc9c021b6653

SHA256
87b20beb01bb6df45f85c23c53b13d92e2db00a8867dbeab1bc410420f3eaf1d

SHA512
bd63cbfce8302f4c376831c28c0b6cbc9e15bde54cd0cedfe2590afb55d8662d3d9d406101b77cd56e7f5f615b9d4d07da0f8af82f3758eaa00bb69c265a40cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
615d43703910c876a5a7f0d1cc492e89

SHA1
fd8b8df1724c79cd915b476749daa9c330987b24

SHA256
5f76be82455ef42d3ff7b41d39b68f8494176e49257009f06b90fd741e2539a7

SHA512
14fa640fcf673815ca330c1fc7837602d40b1f5c62f40d7c9ad4b35c5b6c637246ceeab99cdf0c0aef025263bb7d40027d17ecf644529154fce18532248e55cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
d945af3c64e6704f94fb172d9583b165

SHA1
fc1ec0a941122062534c863654c9084653ceb09b

SHA256
52ba63f03a1862d9f6e39dccf792c0ae11d9302cb14f885653e0c614fe4c23fe

SHA512
15ca9ec703547162544e8118cc6b62bc6fe39b64a294d7e907b8ea48424da1e29f3650c550a34e26ba0d6d77a1441ef9bf0611c946ae2336e260db39aaa3c8d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
8133ce7258a0a733223fbbf5e4995727

SHA1
79d34c61a4a434bf2099852580211f478dad815f

SHA256
9cb29a1312bce3b940bf5d622183464ca7d6a7e24c1f14455c1063d8c8907f19

SHA512
99610bb103bc528d0290f54403638718887c748cfe18654bc5cd21f08214ae333ed83ba2539029af1a97311c216607fd0c881c4ed89dae294e9a906b55873e12

Download Submit
\??\pipe\LOCAL\crashpad_4676_XIMASNBGXVUVEOYF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit