2a1a0cfae648dfa5f8b54ab4bce312bb93463e48deef5832fff7487437186779

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a1a0cfae648dfa5f8b54ab4bce312bb93463e48deef5832fff7487437186779_NeikiAnalytics.dll
Size

72KB
MD5

0add25cdde35d168fd61d1f6cbf4a0a0
SHA1

d01604554903caa42df1dcf91125c40483358638
SHA256

2a1a0cfae648dfa5f8b54ab4bce312bb93463e48deef5832fff7487437186779
SHA512

40d3837edae82ddada206398d1ca506aec681afe8dcdf6bb4d749e2ed57993c7b23a3875de830d8894fcc7d0e61a9c2f28c33207f6863223ba7b2da29676cdbd
SSDEEP

1536:smD6BS7LL1ido9yHSmBmSKmS63DgirIH:spBon1iWyHSCTKTeDgb

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	hrl146D.tmp
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	hrl146D.tmp
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	hrl146D.tmp
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\hrl146D.tmp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hrl146D.tmp:*:enabled:@shell32.dll,-1"	hrl146D.tmp

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	hrl146D.tmp

Executes dropped EXE 2 IoCs

pid	Process
3472	hrl146D.tmp
3128	ewqksq.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	hrl146D.tmp
File opened (read-only)	\??\S:	hrl146D.tmp
File opened (read-only)	\??\W:	hrl146D.tmp
File opened (read-only)	\??\X:	hrl146D.tmp
File opened (read-only)	\??\G:	hrl146D.tmp
File opened (read-only)	\??\P:	hrl146D.tmp
File opened (read-only)	\??\R:	hrl146D.tmp
File opened (read-only)	\??\T:	hrl146D.tmp
File opened (read-only)	\??\Z:	hrl146D.tmp
File opened (read-only)	\??\O:	hrl146D.tmp
File opened (read-only)	\??\U:	hrl146D.tmp
File opened (read-only)	\??\E:	hrl146D.tmp
File opened (read-only)	\??\H:	hrl146D.tmp
File opened (read-only)	\??\J:	hrl146D.tmp
File opened (read-only)	\??\L:	hrl146D.tmp
File opened (read-only)	\??\M:	hrl146D.tmp
File opened (read-only)	\??\N:	hrl146D.tmp
File opened (read-only)	\??\V:	hrl146D.tmp
File opened (read-only)	\??\K:	hrl146D.tmp
File opened (read-only)	\??\Q:	hrl146D.tmp
File opened (read-only)	\??\Y:	hrl146D.tmp

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ewqksq.exe	hrl146D.tmp
File opened for modification	C:\Windows\SysWOW64\ewqksq.exe	hrl146D.tmp

Program crash 1 IoCs

pid	pid_target	Process	procid_target
320	3128	WerFault.exe	93

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3472	hrl146D.tmp
3472	hrl146D.tmp
3128	ewqksq.exe
3128	ewqksq.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp
3472	hrl146D.tmp

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3472	hrl146D.tmp
Token: SeDebugPrivilege	3128	ewqksq.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 1876	5112	rundll32.exe	91
PID 5112 wrote to memory of 1876	5112	rundll32.exe	91
PID 5112 wrote to memory of 1876	5112	rundll32.exe	91
PID 1876 wrote to memory of 3472	1876	rundll32.exe	92
PID 1876 wrote to memory of 3472	1876	rundll32.exe	92
PID 1876 wrote to memory of 3472	1876	rundll32.exe	92
PID 3472 wrote to memory of 612	3472	hrl146D.tmp	5
PID 3472 wrote to memory of 612	3472	hrl146D.tmp	5
PID 3472 wrote to memory of 612	3472	hrl146D.tmp	5
PID 3472 wrote to memory of 612	3472	hrl146D.tmp	5
PID 3472 wrote to memory of 612	3472	hrl146D.tmp	5
PID 3472 wrote to memory of 612	3472	hrl146D.tmp	5
PID 3472 wrote to memory of 668	3472	hrl146D.tmp	7
PID 3472 wrote to memory of 668	3472	hrl146D.tmp	7
PID 3472 wrote to memory of 668	3472	hrl146D.tmp	7
PID 3472 wrote to memory of 668	3472	hrl146D.tmp	7
PID 3472 wrote to memory of 668	3472	hrl146D.tmp	7
PID 3472 wrote to memory of 668	3472	hrl146D.tmp	7
PID 3472 wrote to memory of 772	3472	hrl146D.tmp	8
PID 3472 wrote to memory of 772	3472	hrl146D.tmp	8
PID 3472 wrote to memory of 772	3472	hrl146D.tmp	8
PID 3472 wrote to memory of 772	3472	hrl146D.tmp	8
PID 3472 wrote to memory of 772	3472	hrl146D.tmp	8
PID 3472 wrote to memory of 772	3472	hrl146D.tmp	8
PID 3472 wrote to memory of 780	3472	hrl146D.tmp	9
PID 3472 wrote to memory of 780	3472	hrl146D.tmp	9
PID 3472 wrote to memory of 780	3472	hrl146D.tmp	9
PID 3472 wrote to memory of 780	3472	hrl146D.tmp	9
PID 3472 wrote to memory of 780	3472	hrl146D.tmp	9
PID 3472 wrote to memory of 780	3472	hrl146D.tmp	9
PID 3472 wrote to memory of 784	3472	hrl146D.tmp	10
PID 3472 wrote to memory of 784	3472	hrl146D.tmp	10
PID 3472 wrote to memory of 784	3472	hrl146D.tmp	10
PID 3472 wrote to memory of 784	3472	hrl146D.tmp	10
PID 3472 wrote to memory of 784	3472	hrl146D.tmp	10
PID 3472 wrote to memory of 784	3472	hrl146D.tmp	10
PID 3472 wrote to memory of 904	3472	hrl146D.tmp	11
PID 3472 wrote to memory of 904	3472	hrl146D.tmp	11
PID 3472 wrote to memory of 904	3472	hrl146D.tmp	11
PID 3472 wrote to memory of 904	3472	hrl146D.tmp	11
PID 3472 wrote to memory of 904	3472	hrl146D.tmp	11
PID 3472 wrote to memory of 904	3472	hrl146D.tmp	11
PID 3472 wrote to memory of 956	3472	hrl146D.tmp	12
PID 3472 wrote to memory of 956	3472	hrl146D.tmp	12
PID 3472 wrote to memory of 956	3472	hrl146D.tmp	12
PID 3472 wrote to memory of 956	3472	hrl146D.tmp	12
PID 3472 wrote to memory of 956	3472	hrl146D.tmp	12
PID 3472 wrote to memory of 956	3472	hrl146D.tmp	12
PID 3472 wrote to memory of 332	3472	hrl146D.tmp	13
PID 3472 wrote to memory of 332	3472	hrl146D.tmp	13
PID 3472 wrote to memory of 332	3472	hrl146D.tmp	13
PID 3472 wrote to memory of 332	3472	hrl146D.tmp	13
PID 3472 wrote to memory of 332	3472	hrl146D.tmp	13
PID 3472 wrote to memory of 332	3472	hrl146D.tmp	13
PID 3472 wrote to memory of 728	3472	hrl146D.tmp	14
PID 3472 wrote to memory of 728	3472	hrl146D.tmp	14
PID 3472 wrote to memory of 728	3472	hrl146D.tmp	14
PID 3472 wrote to memory of 728	3472	hrl146D.tmp	14
PID 3472 wrote to memory of 728	3472	hrl146D.tmp	14
PID 3472 wrote to memory of 728	3472	hrl146D.tmp	14
PID 3472 wrote to memory of 680	3472	hrl146D.tmp	15
PID 3472 wrote to memory of 680	3472	hrl146D.tmp	15
PID 3472 wrote to memory of 680	3472	hrl146D.tmp	15
PID 3472 wrote to memory of 680	3472	hrl146D.tmp	15

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:784
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:332

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:772
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:1528
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3688
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3780
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3876
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3956
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3528
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4504
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3856
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:2964
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:4896
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4516

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
PID:680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1140
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2524
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:3184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1412
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1572

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2004

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2644

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2272

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3316
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a1a0cfae648dfa5f8b54ab4bce312bb93463e48deef5832fff7487437186779_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a1a0cfae648dfa5f8b54ab4bce312bb93463e48deef5832fff7487437186779_NeikiAnalytics.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\hrl146D.tmp
      C:\Users\Admin\AppData\Local\Temp\hrl146D.tmp
      4⤵
      Modifies firewall policy service
      Drops file in Drivers directory
      Executes dropped EXE
      Enumerates connected drives
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4964

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff88d9a2e98,0x7ff88d9a2ea4,0x7ff88d9a2eb0
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3080 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3124 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3096 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5332 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5552 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1840 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:4484

C:\Windows\SysWOW64\ewqksq.exe
C:\Windows\SysWOW64\ewqksq.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 400
  2⤵
  - Program crash
  PID:320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3128 -ip 3128
1⤵
PID:1436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hrl146D.tmp

Filesize
64KB

MD5
e2ac54b92a92ab894f9d8e26529d5990

SHA1
9d56e02c2053f21daff516a23c98f9e871c0f73a

SHA256
3c3631ee39fe32fb73dbc634ca30a41a2998e30a0a30d92083a47bd0c632da98

SHA512
44b37743d685940b24a8a5021d8b7c9b5369d3d3f3039bcbdb262d32d08d6e06d2728646f8a002a264dd91c353995fdb0ded1b013f18ab9eeae38b15a50429ab

Download Submit
memory/3128-18-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3472-10-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3472-8-0x00000000777C3000-0x00000000777C4000-memory.dmp

Filesize
4KB

Download
memory/3472-7-0x00000000777C2000-0x00000000777C3000-memory.dmp

Filesize
4KB

Download
memory/3472-9-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3472-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3472-14-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/3472-17-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/3472-16-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/3472-5-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3472-22-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3472-20-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/3472-26-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download