9c9d2307729bfe4b348f0eb4a04991ce633d2b9ea12fd3182f3c67dd9985518b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
Size

464KB
MD5

83bab7b9286354c9cc3fb55269e62088
SHA1

cbc35cedefe6dee32fa94759b212bec76ae832dc
SHA256

246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627
SHA512

ed0f167cbbfd1c33d8cc30856d78d9435d3423fd2bca99ec0ca6d94d632739ffb6b671f68309c86f0d0c8c56a61db96750daeeb9c5138690d36be58912b9ea70
SSDEEP

6144:t5kjHf7sw+GvrsPc5FXCQGOGTywkUb8MyXWMowoqPraQagmrk5ISkwjuO6+JTfiD:0jHf7v5FX0UUb8MhMNoqPWQagmr6Iv

Score

8^/10

discovery upx

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\drivers\afunix.sys	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\drivers\gm.dls	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\drivers\gmreadme.txt	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe

Manipulates Digital Signatures 1 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\wintrust.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2420-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/2420-9-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00050000000006bd-14.dat	upx
behavioral2/memory/2420-106-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/2420-300-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/2420-1014-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/2420-1207-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\clbcatq.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\dpx.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\kstvtune.ax	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\MCCSEngineShared.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\rasdlg.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\winmm.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\mfps.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\MSAlacEncoder.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\msv1_0.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\POSyncServices.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\prnntfy.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\Windows.Devices.Enumeration.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\Windows.Networking.ServiceDiscovery.Dnssd.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\ActionCenterCPL.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\KBDPO.DLL	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\odbccr32.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\rtmmvrortc.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\winspool.drv	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\aspnet_counters.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\CallHistoryClient.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\fltLib.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\ir50_qcxoriginal.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\KBDPL.DLL	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File opened for modification	C:\WINDOWS\SysWOW64\mfc100cht.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\osuninst.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\scripto.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\scrptadm.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\Windows.Media.MediaControl.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\ByteCodeGenerator.exe	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\fdBthProxy.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\mapistub.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\ngclocal.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\scrobj.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\@WirelessDisplayToast.png	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File opened for modification	C:\WINDOWS\SysWOW64\mfc140rus.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\mswdat10.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\provisioningcommandscsp.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\SettingSyncCore.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\sqlwoa.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\srmtrace.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\tracerpt.exe	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\VCardParser.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Wallet.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\mscpxl32.dLL	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\secproc_isv.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\TaskSchdPS.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\windows.applicationmodel.datatransfer.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\Windows.Media.Ocr.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\dxtrans.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\iac25_32.ax	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\KBDFTHRK.DLL	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\pegi.rs	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\SecurityAndMaintenance.png	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\shlwapi.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\LocationApi.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\RdpSaProxy.exe	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\SensorsNativeApi.V2.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\AuthExt.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\C_IS2022.DLL	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\dmprocessxmlfiltered.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\enterpriseresourcemanager.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\msvcp110_win.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\SysWOW64\pots.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\WindowsUpdate.log	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\WMSysPr9.prx	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\bfsvc.exe	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File opened for modification	C:\WINDOWS\DtcInstall.log	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\mib.bin	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File opened for modification	C:\WINDOWS\Professional.xml	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\sysmon.exe	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\hh.exe	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File opened for modification	C:\WINDOWS\SysmonDrv.sys	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\winhlp32.exe	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\write.exe	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File opened for modification	C:\WINDOWS\lsasetup.log	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File opened for modification	C:\WINDOWS\system.ini	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\twain_32.dll	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File opened for modification	C:\WINDOWS\win.ini	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\explorer.exe	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\HelpPane.exe	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\notepad.exe	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File opened for modification	C:\WINDOWS\PFRO.log	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
File created	C:\WINDOWS\splwow64.exe	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4264	msedge.exe
4264	msedge.exe
4392	identity_helper.exe
4392	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4264	2420	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe	95
PID 2420 wrote to memory of 4264	2420	246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe	95
PID 4264 wrote to memory of 224	4264	msedge.exe	96
PID 4264 wrote to memory of 224	4264	msedge.exe	96
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 3144	4264	msedge.exe	97
PID 4264 wrote to memory of 4216	4264	msedge.exe	98
PID 4264 wrote to memory of 4216	4264	msedge.exe	98
PID 4264 wrote to memory of 3732	4264	msedge.exe	99
PID 4264 wrote to memory of 3732	4264	msedge.exe	99
PID 4264 wrote to memory of 3732	4264	msedge.exe	99
PID 4264 wrote to memory of 3732	4264	msedge.exe	99
PID 4264 wrote to memory of 3732	4264	msedge.exe	99
PID 4264 wrote to memory of 3732	4264	msedge.exe	99
PID 4264 wrote to memory of 3732	4264	msedge.exe	99
PID 4264 wrote to memory of 3732	4264	msedge.exe	99
PID 4264 wrote to memory of 3732	4264	msedge.exe	99
PID 4264 wrote to memory of 3732	4264	msedge.exe	99
PID 4264 wrote to memory of 3732	4264	msedge.exe	99
PID 4264 wrote to memory of 3732	4264	msedge.exe	99
PID 4264 wrote to memory of 3732	4264	msedge.exe	99
PID 4264 wrote to memory of 3732	4264	msedge.exe	99
PID 4264 wrote to memory of 3732	4264	msedge.exe	99
PID 4264 wrote to memory of 3732	4264	msedge.exe	99
PID 4264 wrote to memory of 3732	4264	msedge.exe	99
PID 4264 wrote to memory of 3732	4264	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe
"C:\Users\Admin\AppData\Local\Temp\246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627.exe"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.freeav.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80f3646f8,0x7ff80f364708,0x7ff80f364718
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,17048448079019776979,6786362819375252356,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,17048448079019776979,6786362819375252356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,17048448079019776979,6786362819375252356,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17048448079019776979,6786362819375252356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17048448079019776979,6786362819375252356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17048448079019776979,6786362819375252356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
    3⤵
    PID:1728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2004,17048448079019776979,6786362819375252356,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5308 /prefetch:8
    3⤵
    PID:3816
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,17048448079019776979,6786362819375252356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
    3⤵
    PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,17048448079019776979,6786362819375252356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17048448079019776979,6786362819375252356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17048448079019776979,6786362819375252356,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
    3⤵
    PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17048448079019776979,6786362819375252356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17048448079019776979,6786362819375252356,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17048448079019776979,6786362819375252356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17048448079019776979,6786362819375252356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1948 /prefetch:1
    3⤵
    PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17048448079019776979,6786362819375252356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
    3⤵
    PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.antispyware.com/
  2⤵
  PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80f3646f8,0x7ff80f364708,0x7ff80f364718
    3⤵
    PID:804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3328

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x320 0x4a0
1⤵
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
ca0636ad19e6ca358208079e5bb2f935

SHA1
4e4fc7de9ddfca8d0eed316d07e93acd362f747a

SHA256
291fa4afc0208d23f6f43c70703d6ec498ff440bf21a8e79c6299d08f3337d5a

SHA512
13a09642c6f3d65cb30d6cb48c996983654a23e1e4b9f1f920ee878ec0b081205cdcfdf33dfa048f554caa55c900bcd46dd11934f18088a62b3645a0ba99c961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
91604983f6a91beda8e0d3434e609f6f

SHA1
44a715caafbaf48af22359809523efb6e5851a26

SHA256
0c5a03e6d0d4ccfa9c6bb7b5790dc5725f319ff4e6e8f7de3e07b258c16afe86

SHA512
f476e1c4595c3577ca354f12ab7b77649e3e49cc46d557e8243530c8799d22f3cb86f6d4d9ad6aeeae5d701d4c1b9a5aa6342fa6d9c06bfed695d88d6e79c03f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ec0c9f2871ca6cd3f0a021a3b1934144

SHA1
af6887599e9ea1c8e1693332c2dc3dae8e1f9435

SHA256
cda9cd93b62dbff36be4aa49847122b7df6b8e0f5b6e6df95c29eb520fbb71d5

SHA512
e01a537192c4c76dfe32ed753d91f6ffeb2b85c92dd80d0df5a82ac7ed51b4d8aa108bfe0f0f716010e86bdcf319ba87df926ec10dafa76a100cbf9a926e0bf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
93843cebf8f1e8d04a54b0e311a568cd

SHA1
75ecb622b814041f180499673963a58cbc563041

SHA256
e0f32f8462148e67da397c3c5e45f043e24c30ac909c7cf7f587e9d7beb91fcc

SHA512
10b0166f17afb4f987837653c95a3f7605aeb959195661caf4e9d6e40f24617f48d7fcc10d2646641c417090faec96bf51a4c50700398a106e6acdc5cd366e25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a2abd122302372a3463e147499bf07e7

SHA1
66a486647eb0fadd6cf8824b4e6b553353aca903

SHA256
4ff8d4d7afb8e07d26a0696283620dd0f69dd45417394be559b0a1682021a5f0

SHA512
d2fb3eeb7caf24ab841ff441a6d7f5c4a7f60c4aa19f016477a9a80c31128d30b02d1ca6089758417b3d474b8685be93730368f26bf7ebdfbad7a5533bfec830

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d787999e2f7241f6e114ea09d83016e1

SHA1
5c39089af2f1ad2381d2150ae57b3c5af113c974

SHA256
4c9a5072b038676d251fb947a4d90058742692d330d6866bb30e0c00990515b3

SHA512
b3172b3dea3b8d30998ba017bc5e14118abbf4e0ed38e1a2892a83392a3e4983d6e0d03f3413b25bfef6e110fdc0a39a7d1bade8efb6bf0e4c3c2360b5849a8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fde1d0db0de7cc2698d70106e285da8c

SHA1
a67ad3f7bbfa78442c9ec87a7ea77de7645046e7

SHA256
b0f054d9c9403ff3403e15d2ad923b8526bdb1983509a8a4ab445d0ebf6cef17

SHA512
81c979825dd27197ca6c002f5731d6ca714d4aad6ec839986eab5301730a27b9a7adc49dbdb070d72126eb0c2cfb7f16a03aff7b477d35534f861475122008d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5968f1.TMP

Filesize
1KB

MD5
dafff7e3b80c4ea91bc896da84dc2cd0

SHA1
12787391ea079b23688878cce4502c2085c11d47

SHA256
639b59ef1345fad60bbd39ba9191f5ff776c4bad835ee386433cd2a0cf9660f9

SHA512
837819b8bdf1a304c16af44ba4ba51de096f4063a9996ecf5174384ca141345a5fa379195e0202d3bb345c8fd76ede0cccf1730544c0425751e2c0d53528b702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9cd5cf96016a51d560fd03144bf075e2

SHA1
3f035f8a68c1d14d9b8b62a2af8b33553f7675f1

SHA256
ef9eb9074cf0261b951ea6b3a1bd124392b35cdae44f20270d0504a71a177a8d

SHA512
94871565d62f43c1d591bac7ab0b713deada6d8a23493b1fa5daf3dba58627a7d57ff3542fa9f79e2340078c584fb4ca8c8e8e30e22f5f843ae88de502909ba8

Download Submit
C:\Windows\SysmonDrv.sys

Filesize
193KB

MD5
1f1919f10b6ee5dc0e4aabbec7e494ee

SHA1
93655530e467d422ee3c888e8b7c81392330147d

SHA256
5b3afa56a553da8d36749b808ec969a7f416a765e442cb04c100d295f0cb3672

SHA512
16080acf5e72015e8bc10cd6aba38c6766dbf11d4252bb05e671ee4c3528c7c9550aebf99dac0f970aae0f2870c52e83f8a20a8a49da6a817b78d68fd5121e0a

Download Submit
C:\exc.exe

Filesize
436KB

MD5
64a3db50c86da03ec7fea3e6d275e605

SHA1
e988ede8750aa719966bf44bd8cf615cd4930830

SHA256
39f94b6cf04eb478452085a7d045fc74e7b83c41d0aa27c326e4b5e9b181ae9f

SHA512
33987eef16b48d6bde924cccf1a1a5efe1ead0fcf71ab3844b593cba6e9b63880ab6aa8367a549f8b233c1db54bebc7eb9434961f5c6de2b01b703305403f34e

Download Submit
memory/2420-300-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2420-1207-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2420-1014-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2420-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2420-106-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2420-9-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download