phorphiex | 835fa1c2fbba3005e453bab1a36b9a9c77d345197553ade815e5b4e976487e89

Resubmissions

22-06-2024 09:04

240622-k13dvswfpr 10

22-06-2024 05:53

240622-glg8lavbrn 10

Analysis

max time kernel
47s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
22-06-2024 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

835fa1c2fbba3005e453bab1a36b9a9c77d345197553ade815e5b4e976487e89_NeikiAnalytics.exe
Size

9.6MB
MD5

a75e524f17faa4befe802508e16719c0
SHA1

32ff457d4a1c7d11e6a9062bda7e50765edb8de8
SHA256

835fa1c2fbba3005e453bab1a36b9a9c77d345197553ade815e5b4e976487e89
SHA512

40f4b9b98875349515f51cbc242147818de73488a481cd079622249d97471d0e6a714d10cc3d36a495dd4905c5ac5b62d842b7b84ed63d01eb8584e76dd01d9c
SSDEEP

196608:SONojzJF63e3CLEfX3cxLlUiBCfNxBolZkiACy7o:SONojzJF6vEfAZP4PBol1ACy7

Score

10^/10

phorphiex discovery evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

http://185.215.113.66/

http://77.91.77.92/

http://91.202.233.141/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv

rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw

bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3

bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3

Attributes

mutex
55a4er5wo
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Signatures

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

sysmablsvr.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" sysmablsvr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysmablsvr.exe

Phorphiex payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\154494417.exe	family_phorphiex
C:\Users\Admin\AppData\Local\Temp\264337264.exe	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

sysmablsvr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe

Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

4DE1.exe154494417.exesysmablsvr.exe264337264.exe

pid process

1776 4DE1.exe
1188 154494417.exe
4600 sysmablsvr.exe
4692 264337264.exe

pid	process
1776	4DE1.exe
1188	154494417.exe
4600	sysmablsvr.exe
4692	264337264.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

sysmablsvr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

154494417.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe"	154494417.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in Windows directory 2 IoCs

Processes:

154494417.exe

description ioc process

File created C:\Windows\sysmablsvr.exe 154494417.exe
File opened for modification C:\Windows\sysmablsvr.exe 154494417.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\sysmablsvr.exe	154494417.exe
File opened for modification	C:\Windows\sysmablsvr.exe	154494417.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

835fa1c2fbba3005e453bab1a36b9a9c77d345197553ade815e5b4e976487e89_NeikiAnalytics.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
2504	835fa1c2fbba3005e453bab1a36b9a9c77d345197553ade815e5b4e976487e89_NeikiAnalytics.exe
2504	835fa1c2fbba3005e453bab1a36b9a9c77d345197553ade815e5b4e976487e89_NeikiAnalytics.exe
2504	835fa1c2fbba3005e453bab1a36b9a9c77d345197553ade815e5b4e976487e89_NeikiAnalytics.exe
2504	835fa1c2fbba3005e453bab1a36b9a9c77d345197553ade815e5b4e976487e89_NeikiAnalytics.exe
2244	msedge.exe
2244	msedge.exe
4492	msedge.exe
4492	msedge.exe
3396	identity_helper.exe
3396	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

4492 msedge.exe
4492 msedge.exe
4492 msedge.exe
4492 msedge.exe
4492 msedge.exe
4492 msedge.exe
4492 msedge.exe
4492 msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

835fa1c2fbba3005e453bab1a36b9a9c77d345197553ade815e5b4e976487e89_NeikiAnalytics.exe4DE1.exe154494417.exemsedge.exe

description	pid	process	target process
PID 2504 wrote to memory of 1776	2504	835fa1c2fbba3005e453bab1a36b9a9c77d345197553ade815e5b4e976487e89_NeikiAnalytics.exe	4DE1.exe
PID 2504 wrote to memory of 1776	2504	835fa1c2fbba3005e453bab1a36b9a9c77d345197553ade815e5b4e976487e89_NeikiAnalytics.exe	4DE1.exe
PID 2504 wrote to memory of 1776	2504	835fa1c2fbba3005e453bab1a36b9a9c77d345197553ade815e5b4e976487e89_NeikiAnalytics.exe	4DE1.exe
PID 1776 wrote to memory of 1188	1776	4DE1.exe	154494417.exe
PID 1776 wrote to memory of 1188	1776	4DE1.exe	154494417.exe
PID 1776 wrote to memory of 1188	1776	4DE1.exe	154494417.exe
PID 1188 wrote to memory of 4600	1188	154494417.exe	sysmablsvr.exe
PID 1188 wrote to memory of 4600	1188	154494417.exe	sysmablsvr.exe
PID 1188 wrote to memory of 4600	1188	154494417.exe	sysmablsvr.exe
PID 2504 wrote to memory of 4492	2504	835fa1c2fbba3005e453bab1a36b9a9c77d345197553ade815e5b4e976487e89_NeikiAnalytics.exe	msedge.exe
PID 2504 wrote to memory of 4492	2504	835fa1c2fbba3005e453bab1a36b9a9c77d345197553ade815e5b4e976487e89_NeikiAnalytics.exe	msedge.exe
PID 4492 wrote to memory of 4968	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4968	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3468	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 2244	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 2244	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4820	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4820	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4820	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4820	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4820	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4820	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4820	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4820	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4820	4492	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\835fa1c2fbba3005e453bab1a36b9a9c77d345197553ade815e5b4e976487e89_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\835fa1c2fbba3005e453bab1a36b9a9c77d345197553ade815e5b4e976487e89_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2504

C:\Users\Admin\AppData\Local\Temp\4DE1.exe
"C:\Users\Admin\AppData\Local\Temp\4DE1.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776

C:\Users\Admin\AppData\Local\Temp\154494417.exe
C:\Users\Admin\AppData\Local\Temp\154494417.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1188

C:\Windows\sysmablsvr.exe
C:\Windows\sysmablsvr.exe
4⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
PID:4600

C:\Users\Admin\AppData\Local\Temp\264337264.exe
C:\Users\Admin\AppData\Local\Temp\264337264.exe
5⤵
- Executes dropped EXE
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.surfright.nl/downloads/#x64
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b1a046f8,0x7ff9b1a04708,0x7ff9b1a04718
3⤵
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,9942990620979261589,15253634382999299776,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 /prefetch:2
3⤵
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,9942990620979261589,15253634382999299776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,9942990620979261589,15253634382999299776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2976 /prefetch:8
3⤵
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9942990620979261589,15253634382999299776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
3⤵
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9942990620979261589,15253634382999299776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
3⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9942990620979261589,15253634382999299776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
3⤵
PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,9942990620979261589,15253634382999299776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
3⤵
PID:1872

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,9942990620979261589,15253634382999299776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9942990620979261589,15253634382999299776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
3⤵
PID:4264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9942990620979261589,15253634382999299776,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
3⤵
PID:992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9942990620979261589,15253634382999299776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
3⤵
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9942990620979261589,15253634382999299776,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
3⤵
PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9942990620979261589,15253634382999299776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
3⤵
PID:1980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
264B

MD5
3e99fd1a71d299614606189cbc468fb9

SHA1
1a720eaeaa3877fd1b2c48e3a990da84757a2c4a

SHA256
7a0ddbab8a8ab5b444b9d938eba1190d1d38d9dbfeca81ae82cdd628e38d94ac

SHA512
2c130d60dee57d06944cd6e8104c069e7307ab9555ea7f7be68ac7386362ea23e40278a1f464e58b695eeee03845de6d0111606b1214c3bbe34e57c1e100b43a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
9fd31fd65eddcbc3944b21999ea2a8b2

SHA1
bad5d66b0891279c3b502f1ed989f2b995da289e

SHA256
bd7424f067d6f8f34bec67d58c14e98730378af294ce7b57ff8b67554a76acce

SHA512
b94e65ffd3d88b4594803e6990384836ccf88b1ddcb762202ac17a3dbb483d8e6272d5c088e43e9245642e2665a55ca342a02a8bf94e2851c2a718ec1847ad77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
a87edb07241f10db6789fb54183ed92a

SHA1
8c6b447293e1b312a9e81f511ba449840937fd29

SHA256
efe80243e9dce37f0c91784e160dbe0d2b38a439fdc2b12d2a66a8600355c387

SHA512
9c76ae5abad8b2c49fd2a1e73ca5f7a3f3c1f0563987abce024dd8e448f71c6bf6d1f84a06a27deba8fa814ed0241a77be203d89cfe38a8d186f8003988390df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
dd94c2820bf4452a95c63f0d246b8016

SHA1
50ca1316abb53440622ef56d960073bfe1b8cb47

SHA256
ee3856d4b73da1cdaeaf4e188214a9029c4ce003c2df436936a10091b9bc75b9

SHA512
10e6200b2127069ffa4d9daa4fbe572f22f066c19a2c27b3fde71c2c82cac0807530471cb6ca8e9b1562d01b5c24daed0e65ac6d6036bd4fd941f718c351d605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
3fdb95c901ffcc5c23c65641c2e6d8d5

SHA1
8cb5d6257b26bc692eca9379244e7e58fa998cfe

SHA256
3c1ff93dcedd12a3c67e2b7fc6a6855f4bb029eedfec3e2bcb1dff46382f28be

SHA512
5e1918dce3870437ed8e436380a7f24f6fbb560bdbf785579fafe422c15fdf74dce32a89d21f88e0888c6ba46a2150f32fc23bb88b9367c396d485d0cd7b9e0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
454511e35efcbaf8c396222e177b36cc

SHA1
926f50aceab5c290e073b2ca9de53f8a8d3aa7b8

SHA256
8e705b9df87c9cb318f0930ffcf79ad1068cfd952ef4b09f790fdecf9235c8e7

SHA512
5164fcde188cc0417f55689c6c9115f047c1a5a3ac3ac792bcddb52b734ebaec2b44e56b9a3c6c860e6eda06955e32e3c64109f645919b32953ccc0b140b61cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
55329e5aac7afc95e99c73066c3a70ea

SHA1
82c9239ff1136729c36f695f9badbce7f6136f38

SHA256
a94137ad282b7b94587069fb34c18bfdf1b743a5a6c2e927f226820035b8a11a

SHA512
df2f821251ef3081fc243a4985965762555c5a46b640f1adf15d537157c2dcab311405b02edad84ad1eb370a61e03bb7027525dc80b05ee517451cf91c5b9e6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d07576d22378ac63e7b5b6906038063a

SHA1
4dfd01f47f356ab5c0d0b66588b4d584321ab416

SHA256
3df17dbb47b2e70e01b5f475839f145c7f8605f82da493d480891b8a21a6b5a5

SHA512
b282faddac9cdda18f638213ab5edbffe276a8da0a95ac35772be57ddea403e70268005f11bde00182408e76c78c8ad3b473b6ad1f6ef7a28649fb8acc8aedf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\154494417.exe
Filesize
88KB

MD5
4505daf4c08fc8e8e1380911e98588aa

SHA1
d990eb1b2ccbb71c878944be37923b1ebd17bc72

SHA256
a2139600c569365149894405d411ea1401bafc8c7e8af1983d046cf087269c40

SHA512
bb57d11150086c3c61f9a8fdd2511e3e780a24362183a6b833f44484238451f23b74b244262009f38a8baa7254d07dfdd9d4209efcf426dfd4e651c47f2f8cec

Download Submit
C:\Users\Admin\AppData\Local\Temp\264337264.exe
Filesize
88KB

MD5
ababca6d12d96e8dd2f1d7114b406fae

SHA1
dcd9798e83ec688aacb3de8911492a232cb41a32

SHA256
a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba

SHA512
b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\4DE1.exe
Filesize
9KB

MD5
8d8e6c7952a9dc7c0c73911c4dbc5518

SHA1
9098da03b33b2c822065b49d5220359c275d5e94

SHA256
feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

SHA512
91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

Download Submit
\??\pipe\LOCAL\crashpad_4492_PCUUAKHORLMDYRQZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit