179cd1aa53aa185fffc93336a01329ac5df1b36cfd648193041522baa537d40c

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DOC7824047342013202.msi
Size

37.5MB
MD5

98b71a0b67688428a31a04560076fe48
SHA1

3207a44df960415401c4ec59fe33eba7443cda81
SHA256

d015801a54961cd8d98e5abfadd4d325f57948d4033f26487185d08f5d914073
SHA512

6618766db2fae5daacc1a17082c5f07686536712b06a7ffb1e343540b30b62d41e98873a8a319fbcc1af9b13065bb37b385d8bb368e4ccca77a26f1993e1b187
SSDEEP

786432:M8v2InlY7O9Ux5j1cQaubvoUqzza1Yl8qGIEgvtSwMb:Me2Qo5j17aubQZz22XGIECt9Mb

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Atalho para Winste.lnk	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winste.exe = "C:\\Program Files (x86)\\DOC7824047342013202\\DOC7824047342013202\\Winste.exe"	Winste.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	MSI4E25.tmp

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DOC7824047342013202\DOC7824047342013202\avutil.dll	msiexec.exe
File created	C:\Program Files (x86)\DOC7824047342013202\DOC7824047342013202\Winste.exe	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5747d6.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4E25.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI49DD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4B87A360-AF18-4093-9602-45FA782D6C9A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4AE8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5747d6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4882.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4910.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI496F.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
3204	Winste.exe
3684	MSI4E25.tmp

Loads dropped DLL 6 IoCs

pid	Process
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3204	Winste.exe
3204	Winste.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\http:\3.145.213.63\contador\serv.php	Winste.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4420	msiexec.exe
4420	msiexec.exe
4872	msedge.exe
4872	msedge.exe
3720	msedge.exe
3720	msedge.exe
4656	identity_helper.exe
4656	identity_helper.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe
3204	Winste.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	436	msiexec.exe
Token: SeIncreaseQuotaPrivilege	436	msiexec.exe
Token: SeSecurityPrivilege	4420	msiexec.exe
Token: SeCreateTokenPrivilege	436	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	436	msiexec.exe
Token: SeLockMemoryPrivilege	436	msiexec.exe
Token: SeIncreaseQuotaPrivilege	436	msiexec.exe
Token: SeMachineAccountPrivilege	436	msiexec.exe
Token: SeTcbPrivilege	436	msiexec.exe
Token: SeSecurityPrivilege	436	msiexec.exe
Token: SeTakeOwnershipPrivilege	436	msiexec.exe
Token: SeLoadDriverPrivilege	436	msiexec.exe
Token: SeSystemProfilePrivilege	436	msiexec.exe
Token: SeSystemtimePrivilege	436	msiexec.exe
Token: SeProfSingleProcessPrivilege	436	msiexec.exe
Token: SeIncBasePriorityPrivilege	436	msiexec.exe
Token: SeCreatePagefilePrivilege	436	msiexec.exe
Token: SeCreatePermanentPrivilege	436	msiexec.exe
Token: SeBackupPrivilege	436	msiexec.exe
Token: SeRestorePrivilege	436	msiexec.exe
Token: SeShutdownPrivilege	436	msiexec.exe
Token: SeDebugPrivilege	436	msiexec.exe
Token: SeAuditPrivilege	436	msiexec.exe
Token: SeSystemEnvironmentPrivilege	436	msiexec.exe
Token: SeChangeNotifyPrivilege	436	msiexec.exe
Token: SeRemoteShutdownPrivilege	436	msiexec.exe
Token: SeUndockPrivilege	436	msiexec.exe
Token: SeSyncAgentPrivilege	436	msiexec.exe
Token: SeEnableDelegationPrivilege	436	msiexec.exe
Token: SeManageVolumePrivilege	436	msiexec.exe
Token: SeImpersonatePrivilege	436	msiexec.exe
Token: SeCreateGlobalPrivilege	436	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
436	msiexec.exe
436	msiexec.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 3084	4420	msiexec.exe	86
PID 4420 wrote to memory of 3084	4420	msiexec.exe	86
PID 4420 wrote to memory of 3084	4420	msiexec.exe	86
PID 4420 wrote to memory of 3204	4420	msiexec.exe	89
PID 4420 wrote to memory of 3204	4420	msiexec.exe	89
PID 4420 wrote to memory of 3204	4420	msiexec.exe	89
PID 4420 wrote to memory of 3684	4420	msiexec.exe	90
PID 4420 wrote to memory of 3684	4420	msiexec.exe	90
PID 4420 wrote to memory of 3684	4420	msiexec.exe	90
PID 3684 wrote to memory of 3720	3684	MSI4E25.tmp	91
PID 3684 wrote to memory of 3720	3684	MSI4E25.tmp	91
PID 3720 wrote to memory of 1468	3720	msedge.exe	92
PID 3720 wrote to memory of 1468	3720	msedge.exe	92
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4156	3720	msedge.exe	93
PID 3720 wrote to memory of 4872	3720	msedge.exe	94
PID 3720 wrote to memory of 4872	3720	msedge.exe	94
PID 3720 wrote to memory of 532	3720	msedge.exe	95
PID 3720 wrote to memory of 532	3720	msedge.exe	95
PID 3720 wrote to memory of 532	3720	msedge.exe	95
PID 3720 wrote to memory of 532	3720	msedge.exe	95
PID 3720 wrote to memory of 532	3720	msedge.exe	95
PID 3720 wrote to memory of 532	3720	msedge.exe	95
PID 3720 wrote to memory of 532	3720	msedge.exe	95
PID 3720 wrote to memory of 532	3720	msedge.exe	95
PID 3720 wrote to memory of 532	3720	msedge.exe	95

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\DOC7824047342013202.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:436

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E58C7C4EF3A9934E9F6AC682A838A483
  2⤵
  - Loads dropped DLL
  PID:3084
- C:\Program Files (x86)\DOC7824047342013202\DOC7824047342013202\Winste.exe
  "C:\Program Files (x86)\DOC7824047342013202\DOC7824047342013202\Winste.exe"
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  - Loads dropped DLL
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Windows\Installer\MSI4E25.tmp
  "C:\Windows\Installer\MSI4E25.tmp" https://roncluv.com/mx/serv.php
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://roncluv.com/mx/serv.php
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee8a746f8,0x7ffee8a74708,0x7ffee8a74718
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,14073783365900880365,16895758535300744328,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,14073783365900880365,16895758535300744328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,14073783365900880365,16895758535300744328,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
      4⤵
      PID:532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14073783365900880365,16895758535300744328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
      4⤵
      PID:1980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14073783365900880365,16895758535300744328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14073783365900880365,16895758535300744328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14073783365900880365,16895758535300744328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,14073783365900880365,16895758535300744328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
      4⤵
      PID:8
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,14073783365900880365,16895758535300744328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14073783365900880365,16895758535300744328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1
      4⤵
      PID:3476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14073783365900880365,16895758535300744328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14073783365900880365,16895758535300744328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14073783365900880365,16895758535300744328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14073783365900880365,16895758535300744328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14073783365900880365,16895758535300744328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1944 /prefetch:1
      4⤵
      PID:3588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,14073783365900880365,16895758535300744328,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4352 /prefetch:2
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14073783365900880365,16895758535300744328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4396 /prefetch:1
      4⤵
      PID:660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5747d9.rbs

Filesize
1KB

MD5
8b570dceee8de1ca8c98786f37ee2793

SHA1
63c073c75ec018a6ad51d06772a4a2ce840d5930

SHA256
ea9621b496124601ccf32a515bee2921a12dc9e08a8e075a956f224e04f7b4fa

SHA512
a008390d98b1a2aaa8d1a819a8361729fe03d35edffab238675f897b470e7206292d1f6778b376e00882e1167754fafabc938cd0dbae2307bab8bc6e5cdc7238

Download Submit
C:\Program Files (x86)\DOC7824047342013202\DOC7824047342013202\Winste.exe

Filesize
26.1MB

MD5
48d732a19514bef06acc712f43fa7d65

SHA1
f06845844e06879d355824ce1fcfa90244d526ed

SHA256
ba4612db8ce37b8e64d163a4c8e236b0ad2ddc223b91383f270924846394bf95

SHA512
041aaa1c64da4d81a6867a56ebd9d8bfd092bd584c09de05349bce42e3b718a36b45970240f0ec25bf962e59730276e51f116d2f7b609beda6993edfa9248135

Download Submit
C:\Program Files (x86)\DOC7824047342013202\DOC7824047342013202\avutil.dll

Filesize
25.0MB

MD5
6050e226e1dfa61e718d67e894c669d0

SHA1
bb5b4582d58582c7d1a0f5144b690dcef9b2983b

SHA256
e7e256b649d5ad10f55d9228c59b72c2734b2f106af2649f7f55d6a932cc7d61

SHA512
542576bc71a4a55873a52fa26fa3e1fe1ce1c84e8c1ec78980bb4f0959bd6e7fb6cec273f2c179c65f5aff95135022b3af8efe180bb4415ccf976282db2d1051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2bf9694c00396ecfbe96c01cea486547

SHA1
214c68b871e74673b68272057da30c49a643e8b3

SHA256
746f618c1947945dd5899b14a5a6ca29be277a32c5d4383adb11c08b1e22e503

SHA512
c7d06cf017f1426eab479e4ff13fb91431e678a096d3f52eca9ebe55f8759d592fddd7615d85762011a270feb1a8507dd88c1aabc800f04362c1d6f32c1b7781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
82b6ed9b2dba430a2285dd0aaf46ce95

SHA1
d90c736d34f42ff6bfd71df82b9b8d828303bfbe

SHA256
ef46e7ad5596415489029ab7b9d4d91874bca5ff46a5acd7ac77d9c3443eafd6

SHA512
ed75e7e593b6f5f0386a713083b24243fecf8d8ea34af1f08ecacf4df0f57a54c09469ee4463c75ad0ed5474df3033406bee60860d5214242695acab5050c7bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
cef40eb2513a9b90f40e000508bc8927

SHA1
e0d74669fabd04e0af87c30745db878dd218a6ca

SHA256
9441c3d48dd8a8af3f326d4c185ca5fb4b857c9b98ac919316aa5e6e0e0951d9

SHA512
fb2b4a7829c91561513d5c5b130c71b9374fb18b22f3ec6d86937824f46e5a5a3e9c86d12b01053c107aeecc0c6f2a86c6daaaaab1a7e0f31656fd6d6c07b7f6

Download Submit
C:\Windows\Installer\MSI4882.tmp

Filesize
555KB

MD5
53ebdf6bc20011120b06e94de66adc51

SHA1
0c47a3be0ee2dce2e1ffd8c1b40d2ca52d0014f3

SHA256
997b258b3f6dd1448fd4d135a56c138813f45f728e57be0eb1908df5b68f031b

SHA512
16f2b1ec3e6628f49640afedcad302b0af1fe42b8a7a45b99a16fcec5ed68014ee5aa43672ecc92d7fbd83af18bdc3d1ae3efd0a7b7314ba6a4a156aaa5d37cd

Download Submit
C:\Windows\Installer\MSI4E25.tmp

Filesize
409KB

MD5
a7286d5354ef27044c98aad51fc4468e

SHA1
c553b71a417baa43758b241673496ee52579ad81

SHA256
747479cf05918baf2fc3e9228778a1fc2aa7e6660c40bd6105519c52b4f28c67

SHA512
7e0d200b9ba5d983234f8da372e9f683bf5f7bd029a0dea3acb725128be631fc2cf34e941b5eed0654d5101ea7dddf7e094248e4bd5f84351b850c5aec4b244f

Download Submit
memory/3204-102-0x0000000018000000-0x0000000019000000-memory.dmp

Filesize
16.0MB

Download
memory/3204-129-0x0000000006080000-0x0000000006081000-memory.dmp

Filesize
4KB

Download
memory/3204-99-0x0000000006090000-0x0000000006091000-memory.dmp

Filesize
4KB

Download
memory/3204-98-0x0000000006080000-0x0000000006081000-memory.dmp

Filesize
4KB

Download
memory/3204-101-0x00000000060B0000-0x00000000060B1000-memory.dmp

Filesize
4KB

Download
memory/3204-100-0x00000000060A0000-0x00000000060A1000-memory.dmp

Filesize
4KB

Download
memory/3204-97-0x0000000005F40000-0x0000000005F41000-memory.dmp

Filesize
4KB

Download
memory/3204-94-0x0000000000400000-0x0000000001EF2000-memory.dmp

Filesize
26.9MB

Download
memory/3204-96-0x0000000005F30000-0x0000000005F31000-memory.dmp

Filesize
4KB

Download
memory/3204-128-0x0000000005F70000-0x0000000005F71000-memory.dmp

Filesize
4KB

Download
memory/3204-95-0x0000000005F20000-0x0000000005F21000-memory.dmp

Filesize
4KB

Download
memory/3204-130-0x0000000006090000-0x0000000006091000-memory.dmp

Filesize
4KB

Download
memory/3204-131-0x00000000060A0000-0x00000000060A1000-memory.dmp

Filesize
4KB

Download
memory/3204-132-0x0000000018000000-0x0000000019000000-memory.dmp

Filesize
16.0MB

Download
memory/3204-134-0x0000000000400000-0x0000000001EF2000-memory.dmp

Filesize
26.9MB

Download