a7eefc78d074a0985a9a6b11108eb5b325dc3cae4699c18cce7f9148486eb4fb

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8f730c033f7447d429b3b1eec1fe0d86.exe
Size 153KB
Sample240204-sdrb3sefdm
SHA256 a7eefc78d074a0985a9a6b11108eb5b325dc3cae4699c18cce7f9148486eb4fb
MD5 8f730c033f7447d429b3b1eec1fe0d86
SHA1 f38f2a6c57b95d479fb92dc3dd8ad509afa30ac3
SHA512 1138e48f1b8dd1fd5578e6e287b748b2c884a3e7297430fcb4b4229adf94e19b7aeb7e784d0032377cf0ca33c3d3e8de9bc80267e4460ff4feea6ddb365445fc
SSDEEP 3072:QvxetzT1kBMjoQWJQEnUJPIH1TsNyI6SLtA8vIaiJ:yI1kCodm6KPuYNyPSLtlqJ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	8f730c033f7447d429b3b1eec1fe0d86.exe

Loads dropped DLL 1 IoCs

pid	Process
4704	regsvr32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1884-0-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/memory/1884-29-0x0000000000400000-0x0000000000470000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}	regsvr32.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\m.ico	8f730c033f7447d429b3b1eec1fe0d86.exe
File created	C:\Windows\SysWOW64\m3.ico	8f730c033f7447d429b3b1eec1fe0d86.exe
File created	C:\Windows\SysWOW64\s.ico	8f730c033f7447d429b3b1eec1fe0d86.exe
File created	C:\Windows\SysWOW64\gjgsys.dll	8f730c033f7447d429b3b1eec1fe0d86.exe
File created	C:\Windows\SysWOW64\p.ico	8f730c033f7447d429b3b1eec1fe0d86.exe
File created	C:\Windows\SysWOW64\sf.ico	8f730c033f7447d429b3b1eec1fe0d86.exe
File created	C:\Windows\SysWOW64\c.ico	8f730c033f7447d429b3b1eec1fe0d86.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ios.dat	8f730c033f7447d429b3b1eec1fe0d86.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 60 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj.1\CLSID\ = "{BDF6E57E-7330-40CB-8363-D82E9BFF223B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj\CLSID\ = "{BDF6E57E-7330-40CB-8363-D82E9BFF223B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj.1\ = "TrumanBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\InprocServer32\ = "C:\\Windows\\SysWow64\\gjgsys.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\ = "TrumanBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj\ = "TrumanBar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\ = "_Iffgd3cEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj\CurVer\ = "Ho4ydomoj.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\ = "ddf457 Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\gjgsys.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\ProgID\ = "Ho4ydomoj.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\ = "_Iffgd3cEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\ = "Iffgd3c"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\ = "Iffgd3c"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\VersionIndependentProgID\ = "Ho4ydomoj"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
4068	msedge.exe
4068	msedge.exe
4156	identity_helper.exe
4156	identity_helper.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 4704	1884	8f730c033f7447d429b3b1eec1fe0d86.exe	84
PID 1884 wrote to memory of 4704	1884	8f730c033f7447d429b3b1eec1fe0d86.exe	84
PID 1884 wrote to memory of 4704	1884	8f730c033f7447d429b3b1eec1fe0d86.exe	84
PID 1884 wrote to memory of 4068	1884	8f730c033f7447d429b3b1eec1fe0d86.exe	85
PID 1884 wrote to memory of 4068	1884	8f730c033f7447d429b3b1eec1fe0d86.exe	85
PID 4068 wrote to memory of 4276	4068	msedge.exe	86
PID 4068 wrote to memory of 4276	4068	msedge.exe	86
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 4000	4068	msedge.exe	89
PID 4068 wrote to memory of 3688	4068	msedge.exe	87
PID 4068 wrote to memory of 3688	4068	msedge.exe	87
PID 4068 wrote to memory of 4964	4068	msedge.exe	88
PID 4068 wrote to memory of 4964	4068	msedge.exe	88
PID 4068 wrote to memory of 4964	4068	msedge.exe	88
PID 4068 wrote to memory of 4964	4068	msedge.exe	88
PID 4068 wrote to memory of 4964	4068	msedge.exe	88
PID 4068 wrote to memory of 4964	4068	msedge.exe	88
PID 4068 wrote to memory of 4964	4068	msedge.exe	88
PID 4068 wrote to memory of 4964	4068	msedge.exe	88
PID 4068 wrote to memory of 4964	4068	msedge.exe	88
PID 4068 wrote to memory of 4964	4068	msedge.exe	88
PID 4068 wrote to memory of 4964	4068	msedge.exe	88
PID 4068 wrote to memory of 4964	4068	msedge.exe	88
PID 4068 wrote to memory of 4964	4068	msedge.exe	88
PID 4068 wrote to memory of 4964	4068	msedge.exe	88
PID 4068 wrote to memory of 4964	4068	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\8f730c033f7447d429b3b1eec1fe0d86.exe
"C:\Users\Admin\AppData\Local\Temp\8f730c033f7447d429b3b1eec1fe0d86.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\gjgsys.dll
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://configupdatestart.com/bind2.php?id=3913388
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff532f46f8,0x7fff532f4708,0x7fff532f4718
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,8104566789718470462,18023067147060972657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,8104566789718470462,18023067147060972657,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8104566789718470462,18023067147060972657,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8104566789718470462,18023067147060972657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8104566789718470462,18023067147060972657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8104566789718470462,18023067147060972657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
    3⤵
    PID:2980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8104566789718470462,18023067147060972657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8104566789718470462,18023067147060972657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4204 /prefetch:8
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8104566789718470462,18023067147060972657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4204 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8104566789718470462,18023067147060972657,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8104566789718470462,18023067147060972657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8104566789718470462,18023067147060972657,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8104566789718470462,18023067147060972657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8104566789718470462,18023067147060972657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1
    3⤵
    PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8104566789718470462,18023067147060972657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2236 /prefetch:1
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8104566789718470462,18023067147060972657,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 32dd52cc3142b6e758bd60adead81925515b31581437472d1f61bdeda24d5424
MD5 84381d71cf667d9a138ea03b3283aea5
SHA1 33dfc8a32806beaaafaec25850b217c856ce6c7b
SHA512 469bfac06152c8b0a82de28e01f7ed36dc27427205830100b1416b7cd8d481f5c4369e2ba89ef1fdd932aaf17289a8e4ede303393feab25afc1158cb931d23a3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 359fa7f2c4de80e4a5e428c38078218f80152079ebdf0c70bf1d7aa637d79f49
MD5 3c022914ec9c5143d70fb04d369a2d4b
SHA1 db4c68269cd33401333570ca4ce677e080b68f49
SHA512 420eabad2f774538b8c4c26b276881d69af4846929496dbf0cb4bb8798447ed6952249411eb379643f3a5b4ac1504eb1468e60b280d11d370913d8456b9a7b78
SSDEEP 96:nNk7q1xnMwpvWMoiVmdeHeDxUWQyV+VD7AiEwb:nNkGvMGWMXwrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 d3b6ab43b9879a06adcf2346fcba0b8addc39a6eb748ad2592eab8cffaa478b7
MD5 21f38264ce269b2c83a21121759fe37a
SHA1 213e88f0d6287ffe33cd3ac8a7fbd5dff4419abd
SHA512 ac8b1586ceed0996f5fc2f831861e2b19865cfe9de6d48d83aab81074052497fe7920d8b2b82ed475204c523316daf6c62f3cab4c1b2110d7cea7f0dfdcd04d0
SSDEEP 96:nrkAq1xnMwpvWMoiVmdeHeDxUWQyV+VDCzia:nrkfzMGWMXwrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 f0be4c5c99b216083bd9ee878f355e1aa508f94feb14aeebcfba4648d85563a7
MD5 35f77ec6332f541cd8469e0d77af0959
SHA1 abaec73284cee460025c6fcbe3b4d9b6c00f628c
SHA512 e0497dbe48503ebbf6a3c9d188b9637f80bccf9611a9e663d9e4493912d398c6b2a9eab3f506e5b524b3dabbca7bb5a88f882a117b03a3b39f43f291b59870c8
SSDEEP 768:nysWEQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGLltHrUFo4:nysWEQu1jaLLse4
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c9d92e4e9c305cc989f88327ea6e1f81b3f0f26c8097e915b38b5304630d12e2
MD5 4450109e95c5a3493d1d9f4b8dfc5e26
SHA1 acdbdbd8d2597d208a967aea7599c4fb8254385b
SHA512 b41bb45684152f12469fd04c711132f21209d1dc5a31f9dcc14729e601b9697fd5d488618e6991f39f8fbb7bc8bd1d28e6853e6c25aa0e52c541765261473c3a
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup9ozye2RU+7Ebw6hTw8AftH:N9iIxuERzA83h09RZxY9o4pVd86W2v
MD5 SHA1 SHA512 SSDEEP

Submit Download

gjgsys.dll

Path C:\Windows\SysWOW64\gjgsys.dll
Size 216KB
SHA256 e232ef1159527f8ef57f480dcf0399d9b718354e90449545b1a3b7ea30015871
MD5 732cadeaf934ac1edc47f1a577eca711
SHA1 444f18e24d9c48e99b142c85ba6e65cba693988f
SHA512 9b8a8e36b8e7292915a99a47796cd89dab6af4a506bf956093cbcefc24a4b7d3864f26c50d4b4326c38d03a8aca8c4be822e1702b436e9a97b1e084c6e9c0e5f
SSDEEP 3072:OzfGHO8i0Zcn6LXcEnaYQHhE0AReEKHo5LVf:QfG9iaMEnMAReNuJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1884-0-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1884-29-0x0000000000400000-0x0000000000470000-memory.dmp

Download