55aa5ea3f3aea2186f963209015fe71f37244df3149661746f1aaf7545fe95fd

Resubmissions

26-10-2024 07:29

241026-jbgv7asgpp 7

13-04-2024 02:49

240413-dbbfhsaf63 8

Analysis

max time kernel
122s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
13-04-2024 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Geode.dll
Size

7.5MB
MD5

e5ce38e49a3e32be6e04afa0ee5aa9a6
SHA1

271f7f35264c68ccdb29a69e67f044fbeb0f1c2d
SHA256

880ad028b514d58003a916b7eca71c36a2cd8cd87c5e917319ddd74670c5d4d1
SHA512

a40a0c1a64591a3a4aa051fca722913ea922239b16f0745816e159adec4add1f6b58dd7188576d386b5a19aa99b751429b80cd6e8034959f9e312d63b0d54433
SSDEEP

49152:qJMDMcG9YiqnQRCkuR+KATaUGnjlmpdXdIO7RAJv5pAQ0HLPTNqdzO7+1MctuvZQ:b69enQRMwXfRAJvN0rpqdzO7+

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

geode-installer-v2.0.0-beta.23-win.exegeode-installer-v2.0.0-beta.23-win.exe

pid process

1928 geode-installer-v2.0.0-beta.23-win.exe
1412 geode-installer-v2.0.0-beta.23-win.exe

pid	process
1928	geode-installer-v2.0.0-beta.23-win.exe
1412	geode-installer-v2.0.0-beta.23-win.exe

Loads dropped DLL 4 IoCs

Processes:

geode-installer-v2.0.0-beta.23-win.exegeode-installer-v2.0.0-beta.23-win.exe

pid	process
1412	geode-installer-v2.0.0-beta.23-win.exe
1928	geode-installer-v2.0.0-beta.23-win.exe
1928	geode-installer-v2.0.0-beta.23-win.exe
1928	geode-installer-v2.0.0-beta.23-win.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2288054676-1871194608-3559553667-1000\{5B49EEA0-9A36-479C-AC86-A1E17DC25522}	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 583155.crdownload:SmartScreen msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 583155.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
3444	msedge.exe
3444	msedge.exe
1756	msedge.exe
1756	msedge.exe
3480	identity_helper.exe
3480	identity_helper.exe
5384	msedge.exe
5384	msedge.exe
3052	msedge.exe
3052	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

Processes:

pid

4
4
4
4
4
660

pid
4
4
4
4
4
660

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

Processes:

msedge.exe

pid	process
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exemsedge.exe

description	pid	process	target process
PID 1992 wrote to memory of 4824	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 4824	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 4824	1992	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 4496	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4496	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3672	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3444	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 3444	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4828	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4828	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4828	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4828	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4828	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4828	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4828	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4828	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4828	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4828	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4828	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4828	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4828	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4828	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4828	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4828	1756	msedge.exe	msedge.exe
PID 1756 wrote to memory of 4828	1756	msedge.exe	msedge.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
2⤵
PID:4824

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9bf0a46f8,0x7ff9bf0a4708,0x7ff9bf0a4718
2⤵
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
2⤵
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
2⤵
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
2⤵
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
2⤵
PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:1
2⤵
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
2⤵
PID:3992

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
2⤵
PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4396 /prefetch:1
2⤵
PID:3776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
2⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
2⤵
PID:2880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
2⤵
PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
2⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
2⤵
PID:3160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5108 /prefetch:8
2⤵
PID:5376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5060 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
2⤵
PID:5492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
2⤵
PID:5536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:1
2⤵
PID:5960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2108 /prefetch:1
2⤵
PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4944 /prefetch:8
2⤵
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
2⤵
PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5420 /prefetch:8
2⤵
PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
2⤵
PID:5224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,17903600812330356120,6811128391347395996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3052

C:\Users\Admin\Downloads\geode-installer-v2.0.0-beta.23-win.exe
"C:\Users\Admin\Downloads\geode-installer-v2.0.0-beta.23-win.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928

C:\Users\Admin\Downloads\geode-installer-v2.0.0-beta.23-win.exe
"C:\Users\Admin\Downloads\geode-installer-v2.0.0-beta.23-win.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d9da931f98579d9af12b0cddeea667a

SHA1
5f02b023ce6b879af428b39ce9573f2343ef4771

SHA256
ae100e49b8a80ae8b977141fca8c9d0b35112f92af89ebe4dc5dbf2b1311fff0

SHA512
bd338bf14893d2c2f529eb0542b6b82e2beed5614d449c4147a87067f6ba1ff8d7bb178ad56d7b1491acd9d08d5bac5d1906160cf14998a13957117967a28680

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e95d45b99ee46b05441be74a152f3af8

SHA1
76adb523ca3943c8eeb4793a7daaa1f27cbab7d4

SHA256
435d76228edca3be83910f980b82f508e25541918fc3d7c4278a77307c880fb0

SHA512
35ec6bb16d0aba61622e6c9c8d1d4823b8d3e13644ab0b849cace25e0ed2adcf3cd98f6e7e7a24be8c64e360ea3be71523ed12d3c061d88eaa24276bfd91da80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
7081b2e3d000e83fa19b6e1e1305502a

SHA1
0333f6c9273bedb775fcea585ac9c9a34af0b6ff

SHA256
9f32a9e47ea894b9a241d7d37b1d156fa766ee6bfa9b2de214d7491aa6d9bf00

SHA512
a118ef860aa021689c555bd94c99bd6ad9f6a2ba7d85eea1bda3a3488a046c4896ace923fd85cdee652a0c99f1c2362a42a840437794a7657976a5872f53ba37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1ecbd7e97b85e50166722275e8720141

SHA1
a2ee211b41727d72682af690a201f6587b1b1837

SHA256
4064fb5c609aac9cc77a884ddbc69069c70d7c66a2883a17ed6990fda4c8c5da

SHA512
6e1794888e0c30937062bb719737599df5f72c250b28020337c05c538a4ce6db739df3e11e15985d422db6ddc2763cb0bff635c4b86eac225780ffa6f8e6fce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f5d63c36a602c50d1e64c744ac595a7d

SHA1
11e64d254503abaae583c732ae2a9402384f6332

SHA256
da837aff6483101db0f6a05df09903497ceaa50e29ba058e8b4f2a6a5c006324

SHA512
5a2b1b6c853556704b22db18b81398e604e6650a827adcdbc964ed4650ef0abab8f10e125ac9e84afc71342be9ed3cc017169544b61f7ab7240f37114fff9eeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
250973a2e4a197651dc316bbcff3ea80

SHA1
e119af0c30e19946acc93b6db05dc8f5829e6549

SHA256
07fa271c3997c164b217fd14e7ae838227df00eb8ad88d4f4087f04322878310

SHA512
1b9d353ec166511f7370d617cb8b0e93c6f6e77851120724315ec9131d79a2dabcf8bfbdfec93c823b8621c202394aca598ada154108040893d05fb0a1ec0409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6a3187d48d4dac233c9bf29ce3743fb4

SHA1
ec909eab7cf1bd1856dc31551a13733f65bd671b

SHA256
972c232eb93a3c6529bd24138468f447e5b1bc4da4822d16114711a4d3e9812f

SHA512
fdf4ec038a584d604bd39255114a6adb7acdba0e4d572af3c1c136c56536196b206f9f19c63c41a7f92230f53903d0817d4527b5f3d8d4213c52b42dc9ba728f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
00f3be3f5150daa733aa4073980f2356

SHA1
ad8d8f887fd7dfc760c92123b769b80b428c9546

SHA256
0fa076fdbd3baba2a459113c24754353d29fff9c2bec43582ea71feef729400c

SHA512
548b3fc7dc1072da09aeb367bbbfb46c149e2709c5aeaa232c72495b49f3a005b82745635131af24b8aba8d12545d52d803ee6d0fe5d8bd0c401037e718ae5a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
576e83c1432aa0b2a97b98e1e603ee45

SHA1
b8ac02412b03cf249f4943bbd85ebbd85f3a8889

SHA256
a14ba96dfa9b38b9981de1b12529c08bc3e884cb7ecae60f6a3c5418dafd736e

SHA512
3c763bdcccfdf9415cbec63269cf3d88666ed9231143cb002f813ebbcf0d8e2d21d87e179c37bd9f2d35dd0abfe8b9f018ba81c2e1b01699cfc5a8d6f9139266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a9785881191fc6d7137722a1a2a00cf7

SHA1
1ffb2e81029b5ce1ed1f06141a135570f1678f1d

SHA256
b5d4095407bfb9fcc1725a2de3daa0173689d20fef64ff7bb88405b815af00c6

SHA512
9b3abed21804405c574f5d4fa987e6c730e581f4886e251ebe3dd9b2aa834ba3a86c520437f0a13b15136b302bd8a3578c2cd0a5d7b7602f0ac78866ea5c063a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588efc.TMP

Filesize
1KB

MD5
d9b2efff85b63485a8e1d42606a71928

SHA1
9a22b6eb9a60788b1a6bc4bdd609a783c4037fa9

SHA256
c92fbb92ac37cbbd8c2909118138d61d8f75cefb7ce1ba2a3f21d110c13cba41

SHA512
f27850ac02720ffeab8fba705df44e01b1165f528b0bc8033c8ded2ed858aaed4df8376b8c4ea60ce132fa1c836d409d85657d09c998b59fdbf0200b9ffa4fd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5febc645000062091732e6848b8b2d68

SHA1
5cc84fa4b560913b5527be075802b237a5c1ea74

SHA256
89c7a9b639f32cf885b3d3a45f40507bcd5064746ebda83a936757f347c5a1ec

SHA512
3950585988b31ed317dd3423e485e653a78a2973c1b0d62243bb9a2a43feb0cecdc33490e3d914a57213ce520cc70329e6e8edc75d127289f1fff315b642a63c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
30d1db2f549039a35d397ec6ae9eebcc

SHA1
7fe137f8e295a6ca24e613cdf59d301ad3638e3f

SHA256
31209656ae848bd98fde23c2dad5eb263a19710ddc55f01d0d83e1821aae1a9b

SHA512
02e0e734a20a10ad5c2649d96f6cd6b967f755063dc205619495ecf262f668dd1393f82c3f60a6ed7fa9d20841585f9bfee11923b068720ec1e513da8c80b1ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\nskEA7B.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nskEA7B.tmp\modern-wizard.bmp

Filesize
201KB

MD5
3c5626cfc549b9a2fc147f84601a68b1

SHA1
df2015ab7aa2eb9943cc5929fb9f7ec14a26b71e

SHA256
4873a57c9b2d697e4f8689ff7a2f785fb836a6289bc377320987b5541856234c

SHA512
b076a7c5350a8fda2f641c052bab4f87a602f313c91a3c0ceab2da45f9753cd89ee97497a5c67552e65a97de1366e69bfc531f6b728224e86314b90b91fd9511

Download Submit
C:\Users\Admin\AppData\Local\Temp\nskEA7B.tmp\nsDialogs.dll

Filesize
9KB

MD5
1d8f01a83ddd259bc339902c1d33c8f1

SHA1
9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

SHA256
4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

SHA512
28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspE9FE.tmp\LangDLL.dll

Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 583155.crdownload

Filesize
25.7MB

MD5
4d54a270825b2ff973bda4be5e47a8ae

SHA1
db6e7790c2a7f0ec48a86a3a3e63758c92c7b197

SHA256
55aa5ea3f3aea2186f963209015fe71f37244df3149661746f1aaf7545fe95fd

SHA512
e12a7907a355b2fcad259c3de2ea2197c5a48373c9f00458661923fb3427d51e546e2ce85c11c361f9b97fa272f0f12fb6ea73fc0f4db07925f7424c2f193131

Download Submit
\??\pipe\LOCAL\crashpad_1756_QZERNOWUHQTWKFQA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit