d2c736fc70a887dda619b0098ee25efbc75093bd7f4d2937a08e70be8e66f1ec

Resubmissions

24/03/2024, 15:56

240324-tdd77agc8w4

24/03/2024, 15:54

240324-tch5rade983

24/03/2024, 15:47

240324-s8k4jsde857

Analysis

max time kernel
149s
max time network
149s
platform
windows10-1703_x64
resource
win10-20240319-en
resource tags

arch:x64arch:x86image:win10-20240319-enlocale:en-usos:windows10-1703-x64system
submitted
24/03/2024, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ko-Fi.url
Size 122B
Sample240324-s8k4jsde85
SHA256 3c66f3c1f575e486fd6ff50405a53974cec3d8e9badf4d7cd9c045a23ff9658e
MD5 fe014b77eeedfabab4c600fdc4b187c9
SHA1 ca7966ff9b50db38f12ac20c993472a843dac90f
SHA512 e72b4995e4afb1021957b5adfea3f14c14ab487410d974e5088136c9b98f194c27c75fe440812cea73d0e785230782abcb6f829c0a6d3f26818719ba98070d98
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Control Panel\International\Geo\Nation	rundll32.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9b4b59aa027eda01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.google.com\ = "25"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com\NumberOfSubdomain = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ko-fi.com\ = "129"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz!	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.google.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ko-fi.com\Total = "129"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 800da0c0027eda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "418102691"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\ko-fi.com\NumberOfSubdoma = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "66"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1616	MicrosoftEdgeCP.exe
1616	MicrosoftEdgeCP.exe
1616	MicrosoftEdgeCP.exe
1616	MicrosoftEdgeCP.exe
1616	MicrosoftEdgeCP.exe
1616	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1588	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1588	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1588	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2124	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2124	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3564	MicrosoftEdge.exe
1616	MicrosoftEdgeCP.exe
1588	MicrosoftEdgeCP.exe
1616	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77
PID 1616 wrote to memory of 1452	1616	MicrosoftEdgeCP.exe	77

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Ko-Fi.url
1⤵
- Checks computer location settings
PID:3272

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3564

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1400

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1588

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1452

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2868

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
MD5 1bfe591a4fe3d91b03cdf26eaacd8f89
SHA1 719c37c320f518ac168c86723724891950911cea
SHA512 02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
SSDEEP 96:9/nBu64pydcvOHRUfu0xK1bQYMRSRNoYmxYvk56sHMZhh4m:9/nBuP2cGxUfu6K1bpWJ6vfh4m
MD5 SHA1 SHA512 SSDEEP

Submit Download

edgecompatviewlist[1].xml

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\50XPJ0N9\edgecompatviewlist[1].xml
Size 74KB
SHA256 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
MD5 d4fc49dc14f63895d997fa4940f24378
SHA1 3efb1437a7c5e46034147cbbc8db017c69d02c31
SHA512 cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
SSDEEP 768:gL9S+ZZR8+zAmz7B4P/jRLhOzgT6YBNxdvEFd:K9/ZJAA7B2jhT6YTxdvSd
MD5 SHA1 SHA512 SSDEEP

Submit Download

js[2].js

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\3Z0I26MJ\js[2].js
Size 297KB
SHA256 257d0f357125111153cf3457c18ed55995e7f60849fc5f1c0ff01ca1309bcb0e
MD5 d44e61ab11c815565f734f6964131314
SHA1 90bd261e013213b75e6bb13aad91250a57c5a370
SHA512 68117b2b0ca6bcafcdc238b208b54ac35409e030bc692343bce64648c8353efc7ec01a31f82f14cbbb14f1d8c8e39c6c05d9abe05466aa1aa336801abc0d5d20
SSDEEP 3072:4I4lgdQXhE5Oj4BeE05ymz8O7UNbYz82N7YhG46OdnXWoPDnyIVzIuNB0XZoRBqO:J4tXCBb0IwUI82T46OdXWiDyIuuNB0XY
MD5 SHA1 SHA512 SSDEEP

Submit Download

recaptcha__en[1].js

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\HU72HDAG\recaptcha__en[1].js
Size 495KB
SHA256 9368f8ab141b9545a2b9e279abe8fef65a60091050ebeab9b63dd4c1bd0d38e1
MD5 6afd58bec95bc166d3c68166f86e9e67
SHA1 9523c602a5d5610332785397cd26d3b9e18873ab
SHA512 eace418ecd0463b236f076ecfa8bf04e25f7f18eb9b9a0e765410613bcc86784f09d5c33aebf8748de3dcbfc3acddb98ff19a2c2930b5abcd0b2f264af670c5e
SSDEEP 6144:EjXGAUJu3WA8wYRax5mtygJZoy6FQygcpBHgMGchrdTxURCHxKyNrhMa:OGAUJuX8pbygJWFQygcpBHfVhdT867
MD5 SHA1 SHA512 SSDEEP

Submit Download

root[1].css

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\HU72HDAG\root[1].css
Size 5KB
SHA256 fd8f22908896f7a8848ed1970053f97c6329c4d26b233db74df191311574410b
MD5 e55c2a077d1c8f3b99e76b9997aba1e8
SHA1 f635363f14dfe78953343af8e828ff5764dbee75
SHA512 fb3bdc3081c923740ae3b45d9092969af7b9cf8f451a128a7735104d681f08e639088cbda970e750c0d683a7349859f55ed0a985c95b10b7001cbf38c06f62e5
SSDEEP 96:yduBztaFEH//OroDtXQSvcEitD2b8XirsfFil/ATFmqONetxDb6OF2p2/KOPA:JMmAQjitD2b8yrsfFil/kONetxDb6OUh
MD5 SHA1 SHA512 SSDEEP

Submit Download

clipboard[1].js

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\M0VTMF9C\clipboard[1].js
Size 10KB
SHA256 95a40c2992b08790f1c4548c4c72143bfb78c3978cf0f87fe881053985eadf61
MD5 da9d2e5d018c0ba7576c5b139816a257
SHA1 7b2bfacad8f36cb85123c9e5d6f7e8dff8d48824
SHA512 78f20b433828b0671e6801becc3b19ed0728b9bf56aa69ce8248dc889982a338864a97e79a38589afe3c9cf2b39347aaec10da3a7297855ae68b717443845eff
SSDEEP 192:HYB6dpBEbS2jPSeJnDGkkfQG3yCgJ24f/VIBaYsjP3Vgl1JplC:HrpSPSeJnDDkrCTJ243eBfsjP3ClBlC
MD5 SHA1 SHA512 SSDEEP

Submit Download

www.google[1].xml

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\C86NDOUA\www.google[1].xml
Size 99B
SHA256 40307714c220230d520a09ecd9b93aea2c62ceeccfffe354bdc8bbe12dc5c6b0
MD5 2b7221300227918d28d759ab43da3ab6
SHA1 b25fac4ec0a08c1b72394079307ef328e4d255db
SHA512 f573c7e2610a0439d49acdc0f1abb49ef87fc68fb05b0399d00be0afe79ce08a68c3f0912ee85538b18e997b27df145351b405a41829c47451db71066b7eae8b
MD5 SHA1 SHA512

Submit Download

ko-fi[1].xml

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\X2VXKOJH\ko-fi[1].xml
Size 13B
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
MD5 SHA1 SHA512

Submit Download

android-icon-192x192[1].png

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\3UJAE0UD\android-icon-192x192[1].png
Size 12KB
SHA256 92f6fbe52e98aea632ac8f3b62ed27f81ad150f460901628486dc31a73809848
MD5 d9e68215c11565e0cc5fcf11184307f6
SHA1 316783b13821bfbce339fcb02da14ffc1fa5f6ad
SHA512 10147afc98ed93b89fa112b3111eac2c04bbcad6f6e5e8f9fa90567fbc5776b0edb26c96c003cb7097ddc9dedfc48f10d8f02c8c84679a3665eae55165d1c52c
SSDEEP 192:yj54AzkgENw+BNbvBMtjW7Kf6t8J0IMG5xeGGvGJvUL+U/RG4Xp0EVYYrefm9G2+:A4n5BNbGjtS6WJPCYG4XOEBeKG2DghdZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\R6IZ25EG\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1452-317-0x00000297C7B00000-0x00000297C7B02000-memory.dmp

Download

memory/1452-126-0x00000297C7660000-0x00000297C7680000-memory.dmp

Download

memory/1452-283-0x00000297CA200000-0x00000297CA202000-memory.dmp

Download

memory/1452-280-0x00000297CAEC0000-0x00000297CAFC0000-memory.dmp

Download

memory/1452-290-0x00000297CA210000-0x00000297CA212000-memory.dmp

Download

memory/1452-293-0x00000297CA240000-0x00000297CA242000-memory.dmp

Download

memory/1452-297-0x00000297CA3E0000-0x00000297CA3E2000-memory.dmp

Download

memory/1452-304-0x00000297CA520000-0x00000297CA522000-memory.dmp

Download

memory/1452-62-0x00000297B62D0000-0x00000297B62D2000-memory.dmp

Download

memory/1452-320-0x00000297C7F70000-0x00000297C7F72000-memory.dmp

Download

memory/1452-335-0x00000297CB890000-0x00000297CB892000-memory.dmp

Download

memory/1452-257-0x00000297C7B50000-0x00000297C7B52000-memory.dmp

Download

memory/1452-403-0x00000297CCA20000-0x00000297CCA40000-memory.dmp

Download

memory/1452-412-0x00000297C8420000-0x00000297C8520000-memory.dmp

Download

memory/1452-423-0x00000297B5E30000-0x00000297B5E32000-memory.dmp

Download

memory/1452-449-0x00000297CAA70000-0x00000297CAA72000-memory.dmp

Download

memory/1452-517-0x00000297B62E0000-0x00000297B62F0000-memory.dmp

Download

memory/1452-518-0x00000297B62E0000-0x00000297B62F0000-memory.dmp

Download

memory/1452-519-0x00000297B62E0000-0x00000297B62F0000-memory.dmp

Download

memory/1452-520-0x00000297B62E0000-0x00000297B62F0000-memory.dmp

Download

memory/1452-521-0x00000297B62E0000-0x00000297B62F0000-memory.dmp

Download

memory/1452-233-0x00000297C7C00000-0x00000297C7C20000-memory.dmp

Download

memory/1452-265-0x00000297C7FC0000-0x00000297C7FC2000-memory.dmp

Download

memory/1452-108-0x00000297C6EB0000-0x00000297C6ED0000-memory.dmp

Download

memory/1452-67-0x00000297B65D0000-0x00000297B65D2000-memory.dmp

Download

memory/1452-65-0x00000297B6510000-0x00000297B6512000-memory.dmp

Download

memory/3564-0-0x0000026B1C520000-0x0000026B1C530000-memory.dmp

Download

memory/3564-35-0x0000026B1C8D0000-0x0000026B1C8D2000-memory.dmp

Download

memory/3564-16-0x0000026B1CD80000-0x0000026B1CD90000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads