6b5d86495c83f479aeed31a2ec72a0c4934666b48d93f3dd926d2bdf65acc9fb

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe
Size

14.3MB
MD5

3881be410c116d249a71a01c21c43706
SHA1

f84d31e851abea66778e8294439dd523fa65bb74
SHA256

6b5d86495c83f479aeed31a2ec72a0c4934666b48d93f3dd926d2bdf65acc9fb
SHA512

be119cf0498876a1ab83fb8cdc27ec20f9f2bac5d5799c181dd01bf575b632d581a4b1049ef424ca463f1c4388abc93303222dd2b05472584226282184cb84f3
SSDEEP

98304:JLZjmQzW5VPC0vwMdcqSB+cDR9s+kLefGWUsOkSVncYvoNeHm55UGsHaCIyTF558:J5A9wvqSv3KBRoRfodw/f7vNgeXSW0DU

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe

pid process

60 2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Toast.gom = "11000"	2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3968	msedge.exe
3968	msedge.exe
3228	msedge.exe
3228	msedge.exe
3596	identity_helper.exe
3596	identity_helper.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

3228 msedge.exe
3228 msedge.exe
3228 msedge.exe
3228 msedge.exe
3228 msedge.exe
3228 msedge.exe
3228 msedge.exe
3228 msedge.exe

pid	process
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exemsedge.exe

pid	process
60	2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

Processes:

2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exemsedge.exe

pid	process
60	2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe

pid	process
60	2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe
60	2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe
60	2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe
60	2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe
60	2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe
60	2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exemsedge.exe

description	pid	process	target process
PID 60 wrote to memory of 3228	60	2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe	msedge.exe
PID 60 wrote to memory of 3228	60	2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe	msedge.exe
PID 3228 wrote to memory of 1420	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 1420	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3980	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3968	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 3968	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe
PID 3228 wrote to memory of 4880	3228	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_3881be410c116d249a71a01c21c43706_bkransomware.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://playinfo.gomlab.com/ending_browser.gom?product=GOMPLAYER
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8102146f8,0x7ff810214708,0x7ff810214718
    3⤵
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,2719805803676045582,13009509792526091861,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,2719805803676045582,13009509792526091861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,2719805803676045582,13009509792526091861,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2719805803676045582,13009509792526091861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2719805803676045582,13009509792526091861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:1028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2719805803676045582,13009509792526091861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2719805803676045582,13009509792526091861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2719805803676045582,13009509792526091861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
    3⤵
    PID:2996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2719805803676045582,13009509792526091861,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,2719805803676045582,13009509792526091861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 /prefetch:8
    3⤵
    PID:816
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,2719805803676045582,13009509792526091861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2719805803676045582,13009509792526091861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2719805803676045582,13009509792526091861,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
    3⤵
    PID:3760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,2719805803676045582,13009509792526091861,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4176 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
216B

MD5
431514c4581d48eb22c77d8595008876

SHA1
0ccbae7a3980614a6e6aaa93ea0fbf00d4ab6baa

SHA256
e7a04f24db4b9dc313f90fac36ab773e02ee970170937659f348d43a7d30a341

SHA512
2561273609ff9114e266ceeb7fbbf3b68a79db6ef8915d33cd2ea269d98855fe0a3028f51d9d25ef626b2a9bde90ff00a9c566c9d0b9353967eab7acdea7fe8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8942b43785d22bc437f2488a1300e5c3

SHA1
4d3db8e04a4466a7b2dff2d07e09e5afc95c9961

SHA256
0c80de308137483050a6acec72c7145899f07a1e97c677c5e357de32e9946133

SHA512
3f95777898dca9fa3ef3b3839510272140ba6908e2873f3f5fb1e2593516633dc611763d4d2cf170c69b06a9583b1cfdea4a2bd56199cd86d2417c07327c7d3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9c7f826777795aef18b42a6522b2735e

SHA1
cfcae8cafc3d14a867acf8b1a22046e700c1aaf0

SHA256
48f8f1736692f5e1c25bb90646b5cdf9ebbdb5eac9cbeb45c7607fe21982d344

SHA512
c52dd06fe2071bddcb5f53582088d3dcf5488e4e5f91be516a87c78361d61e43fbf6f5fcb41234cd2162d840ed8259743db9d07e1b835ed21350efbc2647db0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a0db40c160a43115837d9fbe2f454098

SHA1
8fcce2806d064acf28436ff52b8afe134cdc35db

SHA256
6c0151e0f8c4a9a135f92f8c365c445fbb7105dbd49da058fc629ad1744dd9fe

SHA512
c80f702ca23959ac69a730a9ebf8cf7bb7406bbdc7f71f158c734cfe44ed7720d89e8f731d77570a6c6383f6af00e2da2b819cba53b17d81f48a89ac767e3665

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d2aa7adb2bddbe1ad53fd25da8b08d90

SHA1
e597af8849e830414c6a8eac20c79b583f6b8863

SHA256
7bc7bf899685689f0fd40d84ef2d4d2d4423a9be14a395d89b061150d9e2529b

SHA512
2fa2d2ef8f80e496f844947742b0465ef6203a7519c9b2eeccbbd82773f86f1b6504be9c14722b95da8eabc16bda875e073885b8e998caa4b66e5bf2a118b66f

Download Submit
\??\pipe\LOCAL\crashpad_3228_QWFKMXQOKXRBYSNY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/60-9-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download