1a3061125a31ff22a63a90216a41dc2c43d1c0886639008d9d6660c638d6566e

Analysis

max time kernel
31s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.msi
Size 1.6MB
Sample240526-ctckvscb52
SHA256 1a3061125a31ff22a63a90216a41dc2c43d1c0886639008d9d6660c638d6566e
MD5 0dc480c255aef834690dfd71c5e2e924
SHA1 9eaa60a6b5c76473c663dfc5c8a0d31ad80a71a8
SHA512 7ed0ddc94db5485594022de67aaf9ab9841f4a781486df3d19aab0dac92ad2c6b1109ebb402ef42f5a0c2db34437dcdb1801f1e50ee6cebf72d842bb11c6c8ef
SSDEEP 49152:qa7ec/f9r84jEHYDgS5u7vJycFTzn795k0zjjZ:MVHYDgrNycl
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
4	1244	msiexec.exe
6	1244	msiexec.exe
8	1244	msiexec.exe
10	1244	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	MSI5C4F.tmp

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI596A.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5758fd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5758fd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A27.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5B05.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C4F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A47.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5B92.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5AB6.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8934CC22-408C-45AB-8FCE-FBE609F282D1}	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
1232	MSI5C4F.tmp

Loads dropped DLL 5 IoCs

pid	Process
1704	MsiExec.exe
1704	MsiExec.exe
1704	MsiExec.exe
1704	MsiExec.exe
1704	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4664	msiexec.exe
4664	msiexec.exe
4672	msedge.exe
4672	msedge.exe
4616	msedge.exe
4616	msedge.exe
1752	identity_helper.exe
1752	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1244	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1244	msiexec.exe
Token: SeSecurityPrivilege	4664	msiexec.exe
Token: SeCreateTokenPrivilege	1244	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1244	msiexec.exe
Token: SeLockMemoryPrivilege	1244	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1244	msiexec.exe
Token: SeMachineAccountPrivilege	1244	msiexec.exe
Token: SeTcbPrivilege	1244	msiexec.exe
Token: SeSecurityPrivilege	1244	msiexec.exe
Token: SeTakeOwnershipPrivilege	1244	msiexec.exe
Token: SeLoadDriverPrivilege	1244	msiexec.exe
Token: SeSystemProfilePrivilege	1244	msiexec.exe
Token: SeSystemtimePrivilege	1244	msiexec.exe
Token: SeProfSingleProcessPrivilege	1244	msiexec.exe
Token: SeIncBasePriorityPrivilege	1244	msiexec.exe
Token: SeCreatePagefilePrivilege	1244	msiexec.exe
Token: SeCreatePermanentPrivilege	1244	msiexec.exe
Token: SeBackupPrivilege	1244	msiexec.exe
Token: SeRestorePrivilege	1244	msiexec.exe
Token: SeShutdownPrivilege	1244	msiexec.exe
Token: SeDebugPrivilege	1244	msiexec.exe
Token: SeAuditPrivilege	1244	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1244	msiexec.exe
Token: SeChangeNotifyPrivilege	1244	msiexec.exe
Token: SeRemoteShutdownPrivilege	1244	msiexec.exe
Token: SeUndockPrivilege	1244	msiexec.exe
Token: SeSyncAgentPrivilege	1244	msiexec.exe
Token: SeEnableDelegationPrivilege	1244	msiexec.exe
Token: SeManageVolumePrivilege	1244	msiexec.exe
Token: SeImpersonatePrivilege	1244	msiexec.exe
Token: SeCreateGlobalPrivilege	1244	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
1244	msiexec.exe
1244	msiexec.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 1704	4664	msiexec.exe	88
PID 4664 wrote to memory of 1704	4664	msiexec.exe	88
PID 4664 wrote to memory of 1704	4664	msiexec.exe	88
PID 4664 wrote to memory of 1232	4664	msiexec.exe	89
PID 4664 wrote to memory of 1232	4664	msiexec.exe	89
PID 4664 wrote to memory of 1232	4664	msiexec.exe	89
PID 1232 wrote to memory of 4616	1232	MSI5C4F.tmp	90
PID 1232 wrote to memory of 4616	1232	MSI5C4F.tmp	90
PID 4616 wrote to memory of 2640	4616	msedge.exe	91
PID 4616 wrote to memory of 2640	4616	msedge.exe	91
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 2088	4616	msedge.exe	92
PID 4616 wrote to memory of 4672	4616	msedge.exe	93
PID 4616 wrote to memory of 4672	4616	msedge.exe	93
PID 4616 wrote to memory of 4532	4616	msedge.exe	94
PID 4616 wrote to memory of 4532	4616	msedge.exe	94
PID 4616 wrote to memory of 4532	4616	msedge.exe	94
PID 4616 wrote to memory of 4532	4616	msedge.exe	94
PID 4616 wrote to memory of 4532	4616	msedge.exe	94
PID 4616 wrote to memory of 4532	4616	msedge.exe	94
PID 4616 wrote to memory of 4532	4616	msedge.exe	94
PID 4616 wrote to memory of 4532	4616	msedge.exe	94
PID 4616 wrote to memory of 4532	4616	msedge.exe	94
PID 4616 wrote to memory of 4532	4616	msedge.exe	94
PID 4616 wrote to memory of 4532	4616	msedge.exe	94
PID 4616 wrote to memory of 4532	4616	msedge.exe	94

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1244

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E5455D5ADB64FE6E115AC285568B4494
  2⤵
  - Loads dropped DLL
  PID:1704
- C:\Windows\Installer\MSI5C4F.tmp
  "C:\Windows\Installer\MSI5C4F.tmp" https://telixsearch.com/tyy
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://telixsearch.com/tyy
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x78,0x108,0x7ffa6bb146f8,0x7ffa6bb14708,0x7ffa6bb14718
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,10392864479077345731,16810399368704886434,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,10392864479077345731,16810399368704886434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,10392864479077345731,16810399368704886434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10392864479077345731,16810399368704886434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10392864479077345731,16810399368704886434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
      4⤵
      PID:2520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,10392864479077345731,16810399368704886434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
      4⤵
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,10392864479077345731,16810399368704886434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10392864479077345731,16810399368704886434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
      4⤵
      PID:1428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10392864479077345731,16810399368704886434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
      4⤵
      PID:904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10392864479077345731,16810399368704886434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
      4⤵
      PID:2240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10392864479077345731,16810399368704886434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
      4⤵
      PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10392864479077345731,16810399368704886434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:1
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10392864479077345731,16810399368704886434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
      4⤵
      PID:5152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e575900.rbs

Path C:\Config.Msi\e575900.rbs
Size 2KB
SHA256 f6dc1547610601fb0e362a7f7f20018a6aa7d7a9c5f7e139d17feccb905ec02d
MD5 9da5e4cb859f9bb1d5302301a1747d22
SHA1 d57b2f70251c745e2e864b9313cedad559267d9d
SHA512 7d7bcfda0dd756b3217e2a0d34b1fd8c345e2f55cb41631bf2bccac8bee48b0e754cf488fce164e5785b6204c239247c4206f3418546c0e062be343fd6dea4a5
MD5 SHA1 SHA512

Submit Download

30069012ED3CF5DB92F9F4FC78D55E2D_16AA5B9B040CB195ADDB70661F18F3C5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30069012ED3CF5DB92F9F4FC78D55E2D_16AA5B9B040CB195ADDB70661F18F3C5
Size 1KB
SHA256 350c0fb456a46f2bf3825e4d570e5ce5adf047bf9174035a49cf1f2af3284042
MD5 45616914d5be0e58e166b5b14d4d601f
SHA1 e354494a8671936bef6a96a2a838749eb2bab662
SHA512 7a161a6d7c50c0f1aa15c1d717cdd1dd653c627952bc4367a019faaea4266ec05e86b3e95363c7d55bb6d54d30c08dcd90ec1f6c2c6d910901d4f181e7fa41fb
MD5 SHA1 SHA512

Submit Download

B03113490075047F519A3F760F0FF379_95980E5E8BBE730A69D3C1EABF291983

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B03113490075047F519A3F760F0FF379_95980E5E8BBE730A69D3C1EABF291983
Size 2KB
SHA256 7d0e89eab32a9a7d79bbdb0f4fd70ac65cdee6f588da769a168d5c09d46228d1
MD5 67752e6074415e7f7bcd779db64e77c0
SHA1 d1821aa42b97eccc581afee6afec340e21c52a95
SHA512 ed09604c9a54cf3811f3f6a78420b05a8c3813c1daaae6b668c5071b96ddbec3b91fcb988d9b91242a5301a1c5ea95eed49c2e32f8b5557882f06b188329819f
MD5 SHA1 SHA512

Submit Download

30069012ED3CF5DB92F9F4FC78D55E2D_16AA5B9B040CB195ADDB70661F18F3C5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30069012ED3CF5DB92F9F4FC78D55E2D_16AA5B9B040CB195ADDB70661F18F3C5
Size 412B
SHA256 1bc2b0f97ecd9b2aebff84af1f58536e0432ab6fd12b7471c7afd3ce58259217
MD5 c2955ff6702a17386f71d9e42f6f211c
SHA1 463dc1fae4baa5237668d7bc1746e45c310c2ec9
SHA512 548370cd6a3e376d869e707d0c4c3921bc48e988a167b541ada3e03ec4b565fedcee1da60836bb69287f867d6704de036050ac66e2b393daeeeb535ed1ed7467
MD5 SHA1 SHA512

Submit Download

B03113490075047F519A3F760F0FF379_95980E5E8BBE730A69D3C1EABF291983

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B03113490075047F519A3F760F0FF379_95980E5E8BBE730A69D3C1EABF291983
Size 428B
SHA256 e89883e11c584376ba1776abfa864d447521ad840b6cc2b33dd81de4cc1375db
MD5 87e1749b0cee3849cbb273acd09e56fa
SHA1 7da2001ec876d4cbc1cec27c8be251540e8b5808
SHA512 6ff1323f5a7280c798e1ec8678caee24a6e955a11b4b044882a3b70927aa62bceb7352c003ad1f05ffcab52e9e7a39155537402fcbdcafde5a179ab7660ead88
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 619B
SHA256 f46826fd90acb8b9ca14b3373b6d19f386e2deb1bd833ace5fa0a2e093eb38c7
MD5 847e5d3bdc14f4177e70dcb1c609a07a
SHA1 cddd11dadb053f31595d1e8bfe531aa2c9be6197
SHA512 03cfa340a02b783e45131d1e854ac7f2c08a934377512e963c136e924e57c24247172091e4d61135c225a3b3263d96a63c3576607c96aa819c8cd36356054b3a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8c63f7bfab3c4b39aca9a5ff5de3320f976500ec6095b19bf0786e96caf0a662
MD5 aa46288be8e4cc574124835ae64cf0fa
SHA1 501a592245bb50fe82f6ffd775e033ef56207d20
SHA512 c8ab2cad3f2daafbd27bf0d0734077c0f35c421d1f152cf6781593106ac365cce074e3a90240613d006a498c065e4eb533010cb9b4d08121cf82ba6fe711abaa
SSDEEP 96:nxkrm1Mn0wpvWMoigfR5mdeIUuKS1j/lvIqyWQyV+VD7AiEwb:nxkaS0GWMEFuth+qlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 082b8bc4d2b82bc7dfa56aa2c1cd19ebdf7604f2aa3b85674f88cc49cc5e0d0f
MD5 3d80f2630292e1b6302249aa0be9909d
SHA1 24acd9c198de99190bc7956f50660ab6a745405d
SHA512 5f2f3d11c4594e291ebfb0c527b86c490bde8b2cb67eee4cc5c46d42c25e89f415bcb0c02433b450b3aeead1b1b5bd4777fed721cbf980720fcf10436309c19f
SSDEEP 96:nxkkm1Mv0wpvWMoiVmdeH/zbIOUWQyV+VDCziEwb:nxkzS8GWMXoOro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 85517554a143d3963bddbda261116d4ee9b11194a96e729e87be1875562d6782
MD5 eccffd40cc6ba41abff925cd59eb540f
SHA1 b1bf488f1ed4ecbcd0a006164ae62e8902a038b0
SHA512 e1de73123adb6ddbb3e7d43dcef29cbfd4a031838bc00ec420831a7f6081a7748036f508cb33ae596104f0b6be814c9620122b9cbde2bb967cf32ecc1c6f5513
SSDEEP 192:4oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDv3e2RUDmyi3z2OMDCRHq+:g9iIxuERzA83h09RZxYj/qiaOMWRHqlA
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI596A.tmp

Path C:\Windows\Installer\MSI596A.tmp
Size 738KB
SHA256 32b60176177d943df28f931828717f4b52b1434b8c0cd3ca8cc8a424b016b092
MD5 8d84543f774c6b280b32b24265e272e8
SHA1 cd3a0dbc06b9b4945f3a5d3b40972a0b5f66044b
SHA512 247c5c3c4765e61b4d4b7514886e9eccb45746593b21a8dc8f718a224a1a0bc813fe227030738c3035cb9a9017ba53d7feff07cccb11407e9b22678af0c42056
SSDEEP 12288:1CIETjR8kJ/FQhGd6rZj5Tzlqph0lhSMXleUnD55vscNzjjZqK:1jEhnJ/mhGd6NFTzqh0lhSMXlLnD55km
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI5C4F.tmp

Path C:\Windows\Installer\MSI5C4F.tmp
Size 416KB
SHA256 8fb5233ae943b6b19d74eb24b26166a3a94808fc8f7940d9bd1aeb07c72a0819
MD5 ab49cf106312bd96667cc8ca5be5d643
SHA1 c004d1b5d967af6a801d22580a52fb873777a267
SHA512 cecc60895516c53e29fad921d54c67ff2b761a43ccec2dbd6b016cb21c71116c1c872346b149d16a1127fdeb5ae169fa13696382e723e946f71a4f8a4bd26a7b
SSDEEP 12288:M6FaqMeU/Hzb9r84jEIWOlDgSNj43HkBX53k17viF:MCaqMr/f9r84jEHYDgOX5017v6
MD5 SHA1 SHA512 SSDEEP

Submit Download