570b9fedcb5914aa74dfe871fde7c82cb80e03b63c490d63c329deb1b032a162

Analysis

max time kernel
98s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/02/2024, 15:10

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

WheelCompatibilityInstaller.exe
Size

10.5MB
MD5

3208c7103288235bc554402efda7fda2
SHA1

410e37d809cb214a7b0d8fca90528eac3ececd8b
SHA256

570b9fedcb5914aa74dfe871fde7c82cb80e03b63c490d63c329deb1b032a162
SHA512

aa995abf1bf8f41b5ab68b232cbb91091239d56bc817b26385fdf70e6b2dd37144b8b95a22ab246654ef320a858bbd14359003cca59412121bbb7e5c9dd57323
SSDEEP

196608:C+pjVt06mXbRV5b+7fUUjAwfbtcYkSasjfHqcXXW/ThuRqSJSS:C8W6mrRHb+7MUjdtIsjfKeXs8A0

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	WheelCompatibilityInstaller.exe

Executes dropped EXE 5 IoCs

pid	Process
2996	WheelCompatibilityInstaller.exe
4856	netcoresearch.exe
1456	WheelCompatibilityInstaller.exe
3324	windowsdesktop-runtime-6.0.12-win-x86.exe
2124	windowsdesktop-runtime-6.0.12-win-x86.exe

Loads dropped DLL 4 IoCs

pid	Process
2996	WheelCompatibilityInstaller.exe
2996	WheelCompatibilityInstaller.exe
4856	netcoresearch.exe
2124	windowsdesktop-runtime-6.0.12-win-x86.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{BEFF6176-3917-4FDC-B9CD-11A66398F7AC} = "\"C:\\ProgramData\\Package Cache\\{BEFF6176-3917-4FDC-B9CD-11A66398F7AC}\\WheelCompatibilityInstaller.exe\" /burn.clean.room /burn.runonce"	WheelCompatibilityInstaller.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000008bec060def88e6600000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800008bec060d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809008bec060d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d8bec060d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008bec060d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "63"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{BEFF6176-3917-4FDC-B9CD-11A66398F7AC}	WheelCompatibilityInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{BEFF6176-3917-4FDC-B9CD-11A66398F7AC}\Version = "1.2.1"	WheelCompatibilityInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{BEFF6176-3917-4FDC-B9CD-11A66398F7AC}\Dependents\{BEFF6176-3917-4FDC-B9CD-11A66398F7AC}	WheelCompatibilityInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{BEFF6176-3917-4FDC-B9CD-11A66398F7AC}\Dependents\{BEFF6176-3917-4FDC-B9CD-11A66398F7AC}	WheelCompatibilityInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{BEFF6176-3917-4FDC-B9CD-11A66398F7AC}\Dependents	WheelCompatibilityInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{BEFF6176-3917-4FDC-B9CD-11A66398F7AC}	WheelCompatibilityInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{BEFF6176-3917-4FDC-B9CD-11A66398F7AC}\ = "{BEFF6176-3917-4FDC-B9CD-11A66398F7AC}"	WheelCompatibilityInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{BEFF6176-3917-4FDC-B9CD-11A66398F7AC}\DisplayName = "Xbox Wheel Compatibility"	WheelCompatibilityInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{BEFF6176-3917-4FDC-B9CD-11A66398F7AC}\Dependents	WheelCompatibilityInstaller.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2700	notepad.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
2880	msedge.exe
2880	msedge.exe
4496	identity_helper.exe
4496	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeBackupPrivilege	1108	vssvc.exe
Token: SeRestorePrivilege	1108	vssvc.exe
Token: SeAuditPrivilege	1108	vssvc.exe
Token: SeBackupPrivilege	1456	WheelCompatibilityInstaller.exe
Token: SeRestorePrivilege	1456	WheelCompatibilityInstaller.exe
Token: SeBackupPrivilege	4568	srtasks.exe
Token: SeRestorePrivilege	4568	srtasks.exe
Token: SeSecurityPrivilege	4568	srtasks.exe
Token: SeTakeOwnershipPrivilege	4568	srtasks.exe
Token: SeBackupPrivilege	4568	srtasks.exe
Token: SeRestorePrivilege	4568	srtasks.exe
Token: SeSecurityPrivilege	4568	srtasks.exe
Token: SeTakeOwnershipPrivilege	4568	srtasks.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
2996	WheelCompatibilityInstaller.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2700	notepad.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4960	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 2996	3548	WheelCompatibilityInstaller.exe	85
PID 3548 wrote to memory of 2996	3548	WheelCompatibilityInstaller.exe	85
PID 2996 wrote to memory of 4856	2996	WheelCompatibilityInstaller.exe	86
PID 2996 wrote to memory of 4856	2996	WheelCompatibilityInstaller.exe	86
PID 2996 wrote to memory of 4856	2996	WheelCompatibilityInstaller.exe	86
PID 2996 wrote to memory of 1456	2996	WheelCompatibilityInstaller.exe	88
PID 2996 wrote to memory of 1456	2996	WheelCompatibilityInstaller.exe	88
PID 2880 wrote to memory of 1896	2880	msedge.exe	100
PID 2880 wrote to memory of 1896	2880	msedge.exe	100
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 1496	2880	msedge.exe	102
PID 2880 wrote to memory of 3372	2880	msedge.exe	101
PID 2880 wrote to memory of 3372	2880	msedge.exe	101
PID 2880 wrote to memory of 3752	2880	msedge.exe	103
PID 2880 wrote to memory of 3752	2880	msedge.exe	103
PID 2880 wrote to memory of 3752	2880	msedge.exe	103
PID 2880 wrote to memory of 3752	2880	msedge.exe	103
PID 2880 wrote to memory of 3752	2880	msedge.exe	103
PID 2880 wrote to memory of 3752	2880	msedge.exe	103
PID 2880 wrote to memory of 3752	2880	msedge.exe	103
PID 2880 wrote to memory of 3752	2880	msedge.exe	103
PID 2880 wrote to memory of 3752	2880	msedge.exe	103
PID 2880 wrote to memory of 3752	2880	msedge.exe	103
PID 2880 wrote to memory of 3752	2880	msedge.exe	103
PID 2880 wrote to memory of 3752	2880	msedge.exe	103
PID 2880 wrote to memory of 3752	2880	msedge.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\WheelCompatibilityInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\WheelCompatibilityInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\TEMP\{D444FBAF-2BCC-4286-8025-BB18B012DA3D}\.cr\WheelCompatibilityInstaller.exe
  "C:\Windows\TEMP\{D444FBAF-2BCC-4286-8025-BB18B012DA3D}\.cr\WheelCompatibilityInstaller.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\WheelCompatibilityInstaller.exe" -burn.filehandle.attached=596 -burn.filehandle.self=592
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\TEMP\{DD6945F8-2E64-4F30-B480-A523B2870600}\.ba\Wix4NetfxBundleExtension_X64\x86\netcoresearch.exe
    "C:\Windows\TEMP\{DD6945F8-2E64-4F30-B480-A523B2870600}\.ba\Wix4NetfxBundleExtension_X64\x86\netcoresearch.exe" runtime 6 Microsoft.WindowsDesktop.App
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4856
- - C:\Windows\TEMP\{DD6945F8-2E64-4F30-B480-A523B2870600}\.be\WheelCompatibilityInstaller.exe
    "C:\Windows\TEMP\{DD6945F8-2E64-4F30-B480-A523B2870600}\.be\WheelCompatibilityInstaller.exe" -q -burn.elevated BurnPipe.{78EF00AF-C6DC-41D3-87F9-304597BC5354} {0E71342E-D43B-4E51-9FF6-B0F44C297653} 2996
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:1456
  - - C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4568
  - - C:\ProgramData\Package Cache\7A827ACFB4C982B05734DB73A1E46F8F50536BC34E9B57ABFF46E5B907ADF5DC\redist\windowsdesktop-runtime-6.0.12-win-x86.exe
      "C:\ProgramData\Package Cache\7A827ACFB4C982B05734DB73A1E46F8F50536BC34E9B57ABFF46E5B907ADF5DC\redist\windowsdesktop-runtime-6.0.12-win-x86.exe" -burn.embedded BurnPipe.{B46812CB-A80F-4551-ADE7-749E8C750527} {23169249-5B44-48A1-A447-4E5018456276} 1456 /install /quiet /log "C:\Users\Admin\AppData\Local\Temp\Xbox_Wheel_Compatibility_20240218151045_000_DesktopNetCoreRuntime6012Redist_x86.log"
      4⤵
      Executes dropped EXE
      PID:3324
    - - C:\Windows\Temp\{67AE605C-5B00-4480-AB55-6058FD816DE6}\.cr\windowsdesktop-runtime-6.0.12-win-x86.exe
        
        "C:\Windows\Temp\{67AE605C-5B00-4480-AB55-6058FD816DE6}\.cr\windowsdesktop-runtime-6.0.12-win-x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\7A827ACFB4C982B05734DB73A1E46F8F50536BC34E9B57ABFF46E5B907ADF5DC\redist\windowsdesktop-runtime-6.0.12-win-x86.exe" -burn.filehandle.attached=688 -burn.filehandle.self=540 -burn.embedded BurnPipe.{B46812CB-A80F-4551-ADE7-749E8C750527} {23169249-5B44-48A1-A447-4E5018456276} 1456 /install /quiet /log "C:\Users\Admin\AppData\Local\Temp\Xbox_Wheel_Compatibility_20240218151045_000_DesktopNetCoreRuntime6012Redist_x86.log"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2124

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffccfb446f8,0x7ffccfb44708,0x7ffccfb44718
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,7012575392794762543,3561173451358130913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7012575392794762543,3561173451358130913,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,7012575392794762543,3561173451358130913,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7012575392794762543,3561173451358130913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7012575392794762543,3561173451358130913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7012575392794762543,3561173451358130913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7012575392794762543,3561173451358130913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7012575392794762543,3561173451358130913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7012575392794762543,3561173451358130913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4780

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\Xbox_Wheel_Compatibility_20240218151045.log
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:2700

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ab055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\7A827ACFB4C982B05734DB73A1E46F8F50536BC34E9B57ABFF46E5B907ADF5DC\redist\windowsdesktop-runtime-6.0.12-win-x86.exe

Filesize
8.4MB

MD5
a993fcb78a200a8c48bbbc6c2f20f4de

SHA1
3c5efee533f5e3a46f8ceaad2c8b9bfbe61d2322

SHA256
98d0638d0c9695c225ad85bf27fbef1fa083b22c06c2b292aa6f3fd03347ba02

SHA512
99db943397799b21cae6cd095fe1530859d03e527b2b7b2a762fb01ae4e69a8b586dfb632661adfd062866b26ea2d93aa7c574437288f2e78361d8b437b48595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d5564ccbd62bac229941d2812fc4bfba

SHA1
0483f8496225a0f2ca0d2151fab40e8f4f61ab6d

SHA256
d259ff04090cbde3b87a54554d6e2b8a33ba81e9483acbbe3e6bad15cbde4921

SHA512
300cda7933e8af577bdc1b20e6d4279d1e418cdb0571c928b1568bfea3c231ba632ccb67313ae73ddeae5586d85db95caffaedd23e973d437f8496a8c5a15025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
03779275bc16321949ee64664591856f

SHA1
a1388da39093534d9e5060c79e0fdf7b265f565c

SHA256
845de8008d764fc29476a26ea1962a6b2186dd655f0e158b20a9c41113564a9c

SHA512
a07b85ee5e68d45dfcb3aaf21bb40d2a19c7df765c8bad4685eabb5118d1016c4a338c9bb104167c65626d66089059fe66385be633c128d44ba12b40c34b9af3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f4a8613861b72e9cf96bf80ff4a032c8

SHA1
c0926e0be5dde40137bb3f5fbe1ac814d725cc09

SHA256
fb5dfcd94da15e4afb4b8b5217273b4eea3627a82b464e1d8c58dad27b7c8b19

SHA512
9c7bd1a7fff991bdf528e8cadfa39f562fb2b7faf5f5a302fe45e389b2b8e22e51cdc0bce0d67d103fae655a99741f4807cf2451fdb8ce34ba7672028a363048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1fed7753ba868ecdc949b0af8bc3f584

SHA1
ec14d20eda5df8b557555d3f72b0098c203b70b5

SHA256
e815511e17f4eda59f502375abbce5cc28eba943d9d091e9099e9d87e3fd3afe

SHA512
d9823b2b40c2dac3a21cbe4ed99bd02ba9c51455b778b3f95034242ad3dbad053a5cd2a8110002d1a6b75d24da1ab59bf9f9e413eae02befce01f97b92ff251b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1d1c7c7f0b54eb8ba4177f9e91af9dce

SHA1
2b0f0ceb9a374fec8258679c2a039fbce4aff396

SHA256
555c13933eae4e0b0e992713ed8118e2980442f89fbdfb06d3914b607edbbb18

SHA512
4c8930fe2c805c54c0076408aba3fbfb08c24566fba9f6a409b5b1308d39c7b26c96717d43223632f1f71d2e9e68a01b43a60031be8f1ca7a541fe0f56f4d9f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
545e2b09a272a720089e5eca9688a05e

SHA1
7b93c7defb7a6b7919899188e146c9f84204ee63

SHA256
daf64bf4849ec35796058a858d12783f853856558da6dddcb3f5584133a4a554

SHA512
9e8d8ac16dd58b9358541af9ecd70bead155f1c463cb9e7bcecf85a99d59198ed84a99f435e252296233dffcaf0c77dfb4cf60c34999c55c148544f637e541dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5fee427c3a8d7a301132ca2109c94373

SHA1
9f7968324447a5307ccab79b7a9bc998841784ee

SHA256
d48957b61c3fec31706b101543ccf49ba0861c17c9c1af70f4b20a76df4e50d7

SHA512
a439935a5a93e6151d15a826994ad1ee7531b400f873459a1c7560f220bc01c24386ff9caf61e6473ade2eab93e0473b788433723b87c0c7193b21d4767ecb62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Xbox_Wheel_Compatibility_20240218151045.log

Filesize
10KB

MD5
a49b4f0f6bf3dc99f2447ca3d8c3bc4a

SHA1
0ec5cd7d077069cd7af48e5cf1c97318860b492d

SHA256
5d178d0066af8e59fc16a6759fba4263d01552dcad7abc62430bfca2b7bcd2e2

SHA512
ebfbde12688d8bd5fefb970f4ee0f0266c2d2083ae23574f02d1fa990650c0a1b62d220305350ddd9bdee9a5dd38946258c491f0b52bb07a4418cbb9aa519bc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\{DD6945F8-2E64-4F30-B480-A523B2870600}\DesktopNetCoreRuntime6012Redist_x86

Filesize
14.2MB

MD5
78addbc5bc4bc935c8f090bee81e3ffe

SHA1
70a7910f204f5e3ca3910d90b7eacc72a4463937

SHA256
3624bc177a53bd313f3a13203f695e35267a48cebe5dfe2f907207b159cdd599

SHA512
ffb271da7eb0e697d6df147b115358cedad2a183b20a3ff25b3d602f4453432ac3918d5d4c64a22b9bd3ba04b5bbaca7609befae9f417de18f334eec9eac2984

Download Submit
C:\Users\Admin\AppData\Local\Temp\{DD6945F8-2E64-4F30-B480-A523B2870600}\WheelCompatibilitySetup

Filesize
2.7MB

MD5
9976b3bbdd9daba9a94c1402b1e4c2e3

SHA1
0cf494fe4ab8f7dabca497835e7135ecfe79ff8b

SHA256
bc9f385dda2abffd99927cdcccbce4007f82208d86e958d34f89d9c0a89cf9de

SHA512
8193cb361a7a02bd3d39fb9f2cd9ad32846adaf7bb7e9b8c0b5c3b48fb5492eed67ccf0a5a474b226f6fcd35301be5385a342040227314c9c06de7285ccd155c

Download Submit
C:\Windows\TEMP\{DD6945F8-2E64-4F30-B480-A523B2870600}\.ba\Wix4NetfxBundleExtension_X64\x86\hostfxr.dll

Filesize
303KB

MD5
4eeb629375a130b40c2cfa7bea9e0c64

SHA1
d7ef02b10209d69152316a79a9fa22b4c3c04e60

SHA256
d39f70554607aec2ed8131c3687a62bdaf809278928b04bdefc1676d00fe726e

SHA512
d8470ba6a5cdef426bfedb20c934ae74b7b609f89d8d6b931269fd4dd9af4b99e8bdd9c7527249fc6935253fc464229e5a3b0741af201686d6cce5e26891825b

Download Submit
C:\Windows\Temp\{67AE605C-5B00-4480-AB55-6058FD816DE6}\.cr\windowsdesktop-runtime-6.0.12-win-x86.exe

Filesize
605KB

MD5
c7cbced39f78187c3cf4321125c726cd

SHA1
1c335ee5d868d9001e58b0c1609478c18c585ecb

SHA256
6432d76da4702f56a93ce75c45d54d2f7d01414784335de18a1e72f0c9bd1f0c

SHA512
bcdf64a24e6f1010f99c5afc9c8430a75329bde4ad6e6eccf6a0e28f30df2026c162a5fb5a06352154b7d772a376ec950db52b1ec2089ed90336ad232c1ca751

Download Submit
C:\Windows\Temp\{67AE605C-5B00-4480-AB55-6058FD816DE6}\.cr\windowsdesktop-runtime-6.0.12-win-x86.exe

Filesize
391KB

MD5
c3869d110d6507c2cad04c34d1d76139

SHA1
ab7623cac33f4da22f8d1fc0ea6a85f2c71b1cdd

SHA256
0ca485d1331db316a01076ba6a88f1c3f6ca90b4abc46776e095df46fc4a3c33

SHA512
0f90140ac67bacdd85770c51ff2793121862d48f1781ad932584da95f37085f1712802097573fe6f484b92f6f3e850a8d4adfb576d8d50ec281c6131b997adf0

Download Submit
C:\Windows\Temp\{D444FBAF-2BCC-4286-8025-BB18B012DA3D}\.cr\WheelCompatibilityInstaller.exe

Filesize
1.6MB

MD5
5af6b17c256109e1fc3f02561c4d1ed0

SHA1
89fcdef401ea5be660d1c480cfad89f292c670be

SHA256
6fd7880b82e947e06ad3341229cd15eecb443da4445e877d66e0ad86a360bfd5

SHA512
7c554c4a448f824c068b9c247485c1a848a262f9171dab562fa6f9b6f97f9e7ff38295346355ff60179dc25e815faf0720520960e918d030ec9a441026b63202

Download Submit
C:\Windows\Temp\{DD6945F8-2E64-4F30-B480-A523B2870600}\.ba\Wix4NetfxBundleExtension_X64\netfxbe.dll

Filesize
184KB

MD5
f18d3785b0d2240a9c96aadbdcfdec3c

SHA1
54be1c28a4f3cdc1c91680fc7942c677182610e0

SHA256
d6e00012e379b36698cebbea74eb6724b3b9864fc2559ecadd1d7b8c2cadeda2

SHA512
0eb83ac0b43d14b71808d2a34c50ac6a8c65bc0372ab17dd19b46fa3fcb8c2927518fd26ebc443622b4bfc433926ed7221f05a7d607ed36c91a4aa75436d689d

Download Submit
C:\Windows\Temp\{DD6945F8-2E64-4F30-B480-A523B2870600}\.ba\Wix4NetfxBundleExtension_X64\x86\netcoresearch.exe

Filesize
133KB

MD5
b9d536bcd864ef81ef246c2d86b96a4f

SHA1
47847e57fa3e2f4da40ca782bcf0ba436392308d

SHA256
167e05509fe8ab691726cd29e0ae493e8d58d1e9cac0ca178562421e258aa93d

SHA512
a1d3c25d572bfb23389169b9e4d2e7e89a3238796598b058b1d4cd08c3ca0896ad3e816bb058497042731c6286b79b06ede945a9b4f31170bacf1f382bc15390

Download Submit
C:\Windows\Temp\{DD6945F8-2E64-4F30-B480-A523B2870600}\.ba\logo.png

Filesize
37KB

MD5
e02048baf6cc1de2db3016f1837ecdc8

SHA1
5d2cf04b67088571a50f09d5046421f0d41703da

SHA256
b96b6d5687350807e6a0628c01a6b0a4d29deb1c460d66ae0669bfceb576f683

SHA512
6c518a447a6da8260cc1f02df94886d6fed274740fccfd9f93d9798696347485473e9c57404b1ed626e4425ddf98ab37f7abe60d8d0928590bc261dd05e67b97

Download Submit
C:\Windows\Temp\{DD6945F8-2E64-4F30-B480-A523B2870600}\.ba\wixstdba.dll

Filesize
366KB

MD5
8ecbd69351f700da51e2d3caea5d8416

SHA1
603782e2608729cf00ffaf1713a80c999e968fb8

SHA256
44d72334bff7f6300c023c37a4d5c961d950d4aca203d21c5739bf78a818fee8

SHA512
d94ef2b573b47eccdc6b92ddb956e93a0620ee8199dbaccd3b02facbd92f48efcbe159973ec352c3d5e0ab6f74b5496c37f60a3a5c361c05184f703996467ab8

Download Submit
C:\Windows\Temp\{F9AA7863-4ADA-4D75-A646-43D738EAC54D}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{F9AA7863-4ADA-4D75-A646-43D738EAC54D}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
13.5MB

MD5
c8677f9246545c586b4fd9c96b2e17c8

SHA1
fab5bb3676f74f2a74e3e9bf5098fca303a9db72

SHA256
9eddd23a4557482e40e83ce985a4dd65be7b994b6e1221023db4b0137964e340

SHA512
47a5f2771d2c69627ceeef5d85aed440fa1b3a7b02ba2bb484ba57f0d4bda3d0b35e7704c7a40467aec064801410ac09234d96855863b77e7d24465d4cbdad83

Download Submit
\??\Volume{0d06ec8b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{fcf1b80f-cb3d-4525-9908-8cf06f41e136}_OnDiskSnapshotProp

Filesize
6KB

MD5
5a66ae60417c06b5014a0a751790b089

SHA1
7ccdb9b0714e44f71e87b54cc373bab395ee3fc7

SHA256
4fcc1dba89f8494e7ead44e624b010bd09fbb43ad2f3c49ca742e56d8359c627

SHA512
bcce0f602a4bb4bf52c5e0ea1d4d8cbf2bc29952caee6af2733f66dc2ffb51e4d583eea34a1654b808aba52d68ef55e5902f9d25151f96407176c97ad7fef41c

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads