Analysis
-
max time kernel
146s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 19:42
Behavioral task
behavioral1
Sample
8ffcef8076920d374af454c1f3b406f9.exe
Resource
win7-20231215-en
General
-
Target
8ffcef8076920d374af454c1f3b406f9.exe
-
Size
153KB
-
MD5
8ffcef8076920d374af454c1f3b406f9
-
SHA1
958bceda667365dc5700d75705afb52b34172872
-
SHA256
c18f66b20db148aff2ff1bc3e2b6634cc8f6f6ed6842fa17839ef435a4ec3d84
-
SHA512
67d3121dc1e148af04fafceb101db34f34648ac2907d67888bc57c3334c2ef95fa89a42015b9368b334e9f1e4ad81ffac72b32820a502924f4420a4682e3cc39
-
SSDEEP
3072:QvxetzT1kBMjoQWJQEnUJPIH1TsNyI6SLtA8vIaiM:yI1kCodm6KPuYNyPSLtlqM
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 8ffcef8076920d374af454c1f3b406f9.exe -
Loads dropped DLL 1 IoCs
pid Process 3208 regsvr32.exe -
resource yara_rule behavioral2/memory/2096-0-0x0000000000400000-0x0000000000470000-memory.dmp upx behavioral2/memory/2096-29-0x0000000000400000-0x0000000000470000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF6E57E-7330-40CB-8363-D82E9BFF223B} regsvr32.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\sf.ico 8ffcef8076920d374af454c1f3b406f9.exe File created C:\Windows\SysWOW64\c.ico 8ffcef8076920d374af454c1f3b406f9.exe File created C:\Windows\SysWOW64\m.ico 8ffcef8076920d374af454c1f3b406f9.exe File created C:\Windows\SysWOW64\m3.ico 8ffcef8076920d374af454c1f3b406f9.exe File created C:\Windows\SysWOW64\s.ico 8ffcef8076920d374af454c1f3b406f9.exe File created C:\Windows\SysWOW64\eyfwin.dll 8ffcef8076920d374af454c1f3b406f9.exe File created C:\Windows\SysWOW64\p.ico 8ffcef8076920d374af454c1f3b406f9.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\ios.dat 8ffcef8076920d374af454c1f3b406f9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 60 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\ = "Iffgd3c" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj.1\ = "TrumanBar" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj\ = "TrumanBar" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\InprocServer32\ = "C:\\Windows\\SysWow64\\eyfwin.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\ProgID\ = "Ho4ydomoj.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\VersionIndependentProgID\ = "Ho4ydomoj" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\ = "Iffgd3c" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\ = "TrumanBar" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\ = "ddf457 Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj\CurVer\ = "Ho4ydomoj.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\ = "_Iffgd3cEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\eyfwin.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj\CLSID\ = "{BDF6E57E-7330-40CB-8363-D82E9BFF223B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDF6E57E-7330-40CB-8363-D82E9BFF223B}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\ = "_Iffgd3cEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj.1\CLSID\ = "{BDF6E57E-7330-40CB-8363-D82E9BFF223B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{685EDF73-6BF2-45EA-A1C1-1C4C0C044307}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ho4ydomoj.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EFB101A-EA9A-4065-B8A4-8963FC57C446}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 804 msedge.exe 804 msedge.exe 5116 msedge.exe 5116 msedge.exe 3016 identity_helper.exe 3016 identity_helper.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2096 wrote to memory of 3208 2096 8ffcef8076920d374af454c1f3b406f9.exe 86 PID 2096 wrote to memory of 3208 2096 8ffcef8076920d374af454c1f3b406f9.exe 86 PID 2096 wrote to memory of 3208 2096 8ffcef8076920d374af454c1f3b406f9.exe 86 PID 2096 wrote to memory of 5116 2096 8ffcef8076920d374af454c1f3b406f9.exe 88 PID 2096 wrote to memory of 5116 2096 8ffcef8076920d374af454c1f3b406f9.exe 88 PID 5116 wrote to memory of 4912 5116 msedge.exe 89 PID 5116 wrote to memory of 4912 5116 msedge.exe 89 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 3908 5116 msedge.exe 91 PID 5116 wrote to memory of 804 5116 msedge.exe 90 PID 5116 wrote to memory of 804 5116 msedge.exe 90 PID 5116 wrote to memory of 2220 5116 msedge.exe 92 PID 5116 wrote to memory of 2220 5116 msedge.exe 92 PID 5116 wrote to memory of 2220 5116 msedge.exe 92 PID 5116 wrote to memory of 2220 5116 msedge.exe 92 PID 5116 wrote to memory of 2220 5116 msedge.exe 92 PID 5116 wrote to memory of 2220 5116 msedge.exe 92 PID 5116 wrote to memory of 2220 5116 msedge.exe 92 PID 5116 wrote to memory of 2220 5116 msedge.exe 92 PID 5116 wrote to memory of 2220 5116 msedge.exe 92 PID 5116 wrote to memory of 2220 5116 msedge.exe 92 PID 5116 wrote to memory of 2220 5116 msedge.exe 92 PID 5116 wrote to memory of 2220 5116 msedge.exe 92 PID 5116 wrote to memory of 2220 5116 msedge.exe 92 PID 5116 wrote to memory of 2220 5116 msedge.exe 92 PID 5116 wrote to memory of 2220 5116 msedge.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ffcef8076920d374af454c1f3b406f9.exe"C:\Users\Admin\AppData\Local\Temp\8ffcef8076920d374af454c1f3b406f9.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\eyfwin.dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://configupdatestart.com/bind2.php?id=39138422⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf99546f8,0x7ffcf9954708,0x7ffcf99547183⤵PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,1722660150891342615,9099823534265754620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1722660150891342615,9099823534265754620,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:23⤵PID:3908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,1722660150891342615,9099823534265754620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:83⤵PID:2220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1722660150891342615,9099823534265754620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:13⤵PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1722660150891342615,9099823534265754620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:13⤵PID:700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1722660150891342615,9099823534265754620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:13⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1722660150891342615,9099823534265754620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:13⤵PID:1448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1722660150891342615,9099823534265754620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:83⤵PID:624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1722660150891342615,9099823534265754620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1722660150891342615,9099823534265754620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:13⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1722660150891342615,9099823534265754620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:13⤵PID:4804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1722660150891342615,9099823534265754620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:13⤵PID:3548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1722660150891342615,9099823534265754620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:13⤵PID:1796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1722660150891342615,9099823534265754620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:13⤵PID:4148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1722660150891342615,9099823534265754620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:13⤵PID:4704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1722660150891342615,9099823534265754620,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4328
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4696
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD57a742df440dfce965bc943b3d52043b3
SHA1b36169f5a8b66c4faee010583872c67b65df04b4
SHA256eea4a0179cf1c166c0509f6caede3bd57b4fe9ff07f62e25b9be1b083366c465
SHA5126868cd6eb7b50cbe0fae51def840761d1003d2193e77d512449113c7fa728cf08cb201a962ec9b2503efd76df5a56252e7cea00a0d2db6b7c6d69ec0c3048be2
-
Filesize
152B
MD51386433ecc349475d39fb1e4f9e149a0
SHA1f04f71ac77cb30f1d04fd16d42852322a8b2680f
SHA256a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc
SHA512fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e
-
Filesize
5KB
MD50591379cac5973852be77ad276026495
SHA181f458db4ef0484e520e660f37306234a267614e
SHA256c0079cbd1beac2a5588e5f3d4b59ba5237661d9944315bdba32581a6260da4f9
SHA5121d3b61279e0649d5310ad08e4074f312c3baf8b580cedcf85f4d56f51467b4383b8e981e6aa3de021e7178aa41d0c8e935d8a67c06fbb47824171ea83d1701be
-
Filesize
5KB
MD5b09b1e217ce2b60ba6be793c23caafa3
SHA1d6debfe5d552293ab8781e8d45dee4a2cfb5635e
SHA256e9713de62aa928411d91507c5bf05e9cc6bd1ab1f494b48703f039876e986193
SHA512ec21be7c597502648e8d74207a9371d3fde762bc853c62263f02ce70fa7be073a2caa364c3ae5390d2e8704e741d0769a6116e14f4be9b629a92f8a6d718e1c8
-
Filesize
24KB
MD5e664066e3aa135f185ed1c194b9fa1f8
SHA1358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5
SHA25686e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617
SHA51258710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
216KB
MD5732cadeaf934ac1edc47f1a577eca711
SHA1444f18e24d9c48e99b142c85ba6e65cba693988f
SHA256e232ef1159527f8ef57f480dcf0399d9b718354e90449545b1a3b7ea30015871
SHA5129b8a8e36b8e7292915a99a47796cd89dab6af4a506bf956093cbcefc24a4b7d3864f26c50d4b4326c38d03a8aca8c4be822e1702b436e9a97b1e084c6e9c0e5f