Overview
overview
7Static
static
3cdba0935f9...0N.exe
windows7-x64
7cdba0935f9...0N.exe
windows10-2004-x64
7$APPDATA/G...ay.exe
windows7-x64
1$APPDATA/G...ay.exe
windows10-2004-x64
3$APPDATA/G...se.htm
windows7-x64
3$APPDATA/G...se.htm
windows10-2004-x64
3$APPDATA/G...er.htm
windows7-x64
6$APPDATA/G...er.htm
windows10-2004-x64
6$APPDATA/G...x.html
windows7-x64
3$APPDATA/G...x.html
windows10-2004-x64
3$APPDATA/G...AQ.htm
windows7-x64
3$APPDATA/G...AQ.htm
windows10-2004-x64
3$APPDATA/G...ai.htm
windows7-x64
3$APPDATA/G...ai.htm
windows10-2004-x64
1$APPDATA/G...er.htm
windows7-x64
3$APPDATA/G...er.htm
windows10-2004-x64
3$APPDATA/G...rs.htm
windows7-x64
3$APPDATA/G...rs.htm
windows10-2004-x64
3$APPDATA/G...ew.chm
windows7-x64
1$APPDATA/G...ew.chm
windows10-2004-x64
1$APPDATA/G...ht.htm
windows7-x64
3$APPDATA/G...ht.htm
windows10-2004-x64
3$APPDATA/G...hv.chm
windows7-x64
1$APPDATA/G...hv.chm
windows10-2004-x64
1$APPDATA/G...e.html
windows7-x64
3$APPDATA/G...e.html
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDIR/fct.dll
windows7-x64
3$PLUGINSDIR/fct.dll
windows10-2004-x64
3bin/IeSear...er.exe
windows7-x64
3bin/IeSear...er.exe
windows10-2004-x64
3Analysis
- max time kernel
113s - max time network
107s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
06/09/2024, 04:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
cdba0935f95f8e97ffadb50d510ace60N.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
120 seconds
Behavioral task
behavioral2
Sample
cdba0935f95f8e97ffadb50d510ace60N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
15 signatures
120 seconds
Behavioral task
behavioral3
Sample
$APPDATA/Genieo/Application/TrayUi/bin/gentray.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
120 seconds
Behavioral task
behavioral4
Sample
$APPDATA/Genieo/Application/TrayUi/bin/gentray.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
120 seconds
Behavioral task
behavioral5
Sample
$APPDATA/Genieo/Application/license/Apache log4j 1.2 - Project License.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
120 seconds
Behavioral task
behavioral6
Sample
$APPDATA/Genieo/Application/license/Apache log4j 1.2 - Project License.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
120 seconds
Behavioral task
behavioral7
Sample
$APPDATA/Genieo/Application/license/IE HistoryView Freeware Internet Explorer History Viewer.htm
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
Behavioral task
behavioral8
Sample
$APPDATA/Genieo/Application/license/IE HistoryView Freeware Internet Explorer History Viewer.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
120 seconds
Behavioral task
behavioral9
Sample
$APPDATA/Genieo/Application/license/JDIC_Plus_index.html
Resource
win7-20240903-en
windows7-x64
5 signatures
120 seconds
Behavioral task
behavioral10
Sample
$APPDATA/Genieo/Application/license/JDIC_Plus_index.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
120 seconds
Behavioral task
behavioral11
Sample
$APPDATA/Genieo/Application/license/JDOM_FAQ.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
120 seconds
Behavioral task
behavioral12
Sample
$APPDATA/Genieo/Application/license/JDOM_FAQ.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
120 seconds
Behavioral task
behavioral13
Sample
$APPDATA/Genieo/Application/license/JavaMail API Reference Implementation Project Kenai.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
120 seconds
Behavioral task
behavioral14
Sample
$APPDATA/Genieo/Application/license/JavaMail API Reference Implementation Project Kenai.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
120 seconds
Behavioral task
behavioral15
Sample
$APPDATA/Genieo/Application/license/Launch4j - Cross-platform Java executable wrapper.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
120 seconds
Behavioral task
behavioral16
Sample
$APPDATA/Genieo/Application/license/Launch4j - Cross-platform Java executable wrapper.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
120 seconds
Behavioral task
behavioral17
Sample
$APPDATA/Genieo/Application/license/MozilaHistoryViewbrowsers.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
120 seconds
Behavioral task
behavioral18
Sample
$APPDATA/Genieo/Application/license/MozilaHistoryViewbrowsers.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
120 seconds
Behavioral task
behavioral19
Sample
$APPDATA/Genieo/Application/license/MozillaHistoryView/MozillaHistoryView.chm
Resource
win7-20240903-en
windows7-x64
2 signatures
120 seconds
Behavioral task
behavioral20
Sample
$APPDATA/Genieo/Application/license/MozillaHistoryView/MozillaHistoryView.chm
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
120 seconds
Behavioral task
behavioral21
Sample
$APPDATA/Genieo/Application/license/SQLite Copyright.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
120 seconds
Behavioral task
behavioral22
Sample
$APPDATA/Genieo/Application/license/SQLite Copyright.htm
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
120 seconds
Behavioral task
behavioral23
Sample
$APPDATA/Genieo/Application/license/iehv/iehv.chm
Resource
win7-20240708-en
windows7-x64
2 signatures
120 seconds
Behavioral task
behavioral24
Sample
$APPDATA/Genieo/Application/license/iehv/iehv.chm
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
120 seconds
Behavioral task
behavioral25
Sample
$APPDATA/Genieo/Application/license/license.html
Resource
win7-20240729-en
windows7-x64
5 signatures
120 seconds
Behavioral task
behavioral26
Sample
$APPDATA/Genieo/Application/license/license.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
120 seconds
Behavioral task
behavioral27
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral28
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/fct.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/fct.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
Behavioral task
behavioral31
Sample
bin/IeSearchProvider.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
120 seconds
Behavioral task
behavioral32
Sample
bin/IeSearchProvider.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
120 seconds
General
- Target cdba0935f95f8e97ffadb50d510ace60N.exe
- Size 482KB
- Sample240906-ffhfqsxbmm
- SHA256 af8b500428ae1502c2b6c3ed6f91714b873f8c4f418847cd234fb2b9e2b5a0c2
- MD5 cdba0935f95f8e97ffadb50d510ace60
- SHA1 22940e1590aaa949c23faeaf02c46c0e1c8c9d6a
- SHA512 d6428c70a44b77ad441ecd806a80e5c4f56400cc41e6675598f86d467b3ec6870787d0304dbe183a6e7f510e869f54c12081db67d58f685d62e11cd8c0565f2e
- SSDEEP 12288:ZpG3lMqLngPixjkRGAy4EkqDkJE+FUsr0v:ZSMqLgPilOytc2cLr0v
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation genupdater.exe - Executes dropped EXE 6 IoCs
pid Process 3944 gentray.exe 964 genupdater.exe 2056 genupdater.exe 884 updater_uninstall.exe 4524 Au_.exe 4604 gentray.exe - Loads dropped DLL 7 IoCs
pid Process 4064 cdba0935f95f8e97ffadb50d510ace60N.exe 4064 cdba0935f95f8e97ffadb50d510ace60N.exe 4064 cdba0935f95f8e97ffadb50d510ace60N.exe 4524 Au_.exe 4524 Au_.exe 4524 Au_.exe 4524 Au_.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GenieoUpdaterService = "\"C:\\Users\\Admin\\AppData\\Roaming\\Genieo\\Application\\Updater\\bin\\genupdater.exe\" -wait 5" cdba0935f95f8e97ffadb50d510ace60N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GenieoSystemTray = "\"C:\\Users\\Admin\\AppData\\Roaming\\Genieo\\Application\\TrayUi\\bin\\gentray.exe\"" cdba0935f95f8e97ffadb50d510ace60N.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language updater_uninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gentray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cdba0935f95f8e97ffadb50d510ace60N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gentray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language genupdater.exe - NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x000700000002344b-128.dat nsis_installer_1 behavioral2/files/0x000700000002344b-128.dat nsis_installer_2 - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main gentray.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes gentray.exe - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4064 cdba0935f95f8e97ffadb50d510ace60N.exe 4064 cdba0935f95f8e97ffadb50d510ace60N.exe 4064 cdba0935f95f8e97ffadb50d510ace60N.exe 4064 cdba0935f95f8e97ffadb50d510ace60N.exe 964 genupdater.exe 964 genupdater.exe 3944 gentray.exe 3944 gentray.exe 1500 msedge.exe 1500 msedge.exe 3048 msedge.exe 3048 msedge.exe 4252 identity_helper.exe 4252 identity_helper.exe 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 4524 Au_.exe 4524 Au_.exe 4524 Au_.exe 4524 Au_.exe 3944 gentray.exe 3944 gentray.exe 4524 Au_.exe 4524 Au_.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe - Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe - Suspicious use of SendNotifyMessage 31 IoCs
pid Process 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3944 gentray.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4064 wrote to memory of 3944 4064 cdba0935f95f8e97ffadb50d510ace60N.exe 86 PID 4064 wrote to memory of 3944 4064 cdba0935f95f8e97ffadb50d510ace60N.exe 86 PID 4064 wrote to memory of 3944 4064 cdba0935f95f8e97ffadb50d510ace60N.exe 86 PID 4064 wrote to memory of 964 4064 cdba0935f95f8e97ffadb50d510ace60N.exe 87 PID 4064 wrote to memory of 964 4064 cdba0935f95f8e97ffadb50d510ace60N.exe 87 PID 4064 wrote to memory of 964 4064 cdba0935f95f8e97ffadb50d510ace60N.exe 87 PID 964 wrote to memory of 2056 964 genupdater.exe 90 PID 964 wrote to memory of 2056 964 genupdater.exe 90 PID 964 wrote to memory of 2056 964 genupdater.exe 90 PID 964 wrote to memory of 4512 964 genupdater.exe 101 PID 964 wrote to memory of 4512 964 genupdater.exe 101 PID 964 wrote to memory of 4512 964 genupdater.exe 101 PID 4512 wrote to memory of 3048 4512 rundll32.exe 102 PID 4512 wrote to memory of 3048 4512 rundll32.exe 102 PID 3048 wrote to memory of 3904 3048 msedge.exe 103 PID 3048 wrote to memory of 3904 3048 msedge.exe 103 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1304 3048 msedge.exe 104 PID 3048 wrote to memory of 1500 3048 msedge.exe 105 PID 3048 wrote to memory of 1500 3048 msedge.exe 105 PID 3048 wrote to memory of 3644 3048 msedge.exe 106 PID 3048 wrote to memory of 3644 3048 msedge.exe 106 PID 3048 wrote to memory of 3644 3048 msedge.exe 106 PID 3048 wrote to memory of 3644 3048 msedge.exe 106 PID 3048 wrote to memory of 3644 3048 msedge.exe 106 PID 3048 wrote to memory of 3644 3048 msedge.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdba0935f95f8e97ffadb50d510ace60N.exe"C:\Users\Admin\AppData\Local\Temp\cdba0935f95f8e97ffadb50d510ace60N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Roaming\Genieo\Application\TrayUi\bin\gentray.exe"C:\Users\Admin\AppData\Roaming\Genieo\Application\TrayUi\bin\gentray.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3944
-
-
C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\bin\genupdater.exe"C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\bin\genupdater.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\bin\genupdater.exe"C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\bin\genupdater.exe" -wait 3603⤵
- Executes dropped EXE
PID:2056
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" url.dll,FileProtocolHandler http://userfeedback-genieo.appspot.com/installfail.jsp?errcode=140000073⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://userfeedback-genieo.appspot.com/installfail.jsp?errcode=140000074⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1e3c46f8,0x7ffd1e3c4708,0x7ffd1e3c47185⤵PID:3904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:25⤵PID:1304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:1500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:85⤵PID:3644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:15⤵PID:3176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:15⤵PID:2500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:85⤵PID:1628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
PID:4252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:15⤵PID:3992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:15⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:15⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:15⤵PID:4980
-
-
-
-
C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\uninstall\updater_uninstall.exe"C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\uninstall\updater_uninstall.exe" /S -skip_check true3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:884 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" /S -skip_check true _?=C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\uninstall\4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4524 -
C:\Users\Admin\AppData\Roaming\Genieo\Application\TrayUi\bin\gentray.exe"C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\..\TrayUi\bin\gentray.exe" -kill5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4604
-
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4980
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2792
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
- MD5 b9569e123772ae290f9bac07e0d31748
- SHA1 5806ed9b301d4178a959b26d7b7ccf2c0abc6741
- SHA512 cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
- MD5 eeaa8087eba2f63f31e599f6a7b46ef4
- SHA1 f639519deee0766a39cfe258d2ac48e3a9d5ac03
- SHA512 eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 1f4ee82c82141f73d39b22b41104d5cd5267ee7386870a5145127264d4c2a474
- MD5 2934c24b6108859438c34e4e8fd85bcd
- SHA1 251251ab11a6ca71ae3f4c5716ba01303105577a
- SHA512 fff190645dabe8841600e6999e5f57c259a65a6b61ddc50a5c0190f7e782351b979982b2f44b677cc67f3aec33f17088a417785a7334a70c2d3fee31d05e20ae
- SSDEEP 96:nxkzXJ116wpvWMoiVmdeHk8LUWQyV+VDCziEwb:nxkz5b6GWMXFro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 97727d8f3a2e29e72e1729018d97e41bd43c5c430c18e691eef5b311035682b6
- MD5 305abcb2ec1ae1359c641733515a53f6
- SHA1 30387380fcd9ff3712ac04267d0f939d1a6a6ab4
- SHA512 f29469777d86b17d9d0a33aa107c5726f3fbf4f68044805acee7906456578a570bc81fc660ef0ab8106c7b27a761ec2a11875cfa3a27651c162fd9e878fa8e7d
- SSDEEP 96:nxkzfJ116wpvWMoiVmdeOuh1jknLUWQyV+VD7AiEwb:nxkzxb6GWM+uhh6rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 27361a3e131bb31abf450f4235185b79ce1d9837756760e0b372fd36c0eadcb5
- MD5 56ba606d8f3760aee00457488c742436
- SHA1 3602352f2ffbe47ebcbd32a4a12b27edc29b5702
- SHA512 fc0a9baec072b5ad7b950c6400ba6c3e3616321d1d9feb468a3ec0fe7d99f26ce4c8d08b0397ae17f3d0ece7247b905a20cd290837c1e598646d822b082e9bd1
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupMe2RUkIxnlLQOl6feAOu:A9iIxuERzA83h09RZxYSnClSf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso832C.tmp\KillProcDLL.dll
- Size 32KB
- SHA256 ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
- MD5 83142eac84475f4ca889c73f10d9c179
- SHA1 dbe43c0de8ef881466bd74861b2e5b17598b5ce8
- SHA512 1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
- SSDEEP 384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso832C.tmp\fct.dll
- Size 4KB
- SHA256 010f5e0c69b4a630b08b2551e03d8044a33350f151848dcf50953407012fab29
- MD5 e3f3809f51c7982d96aaf9c090f7d176
- SHA1 7494daa8000c0b31c58d94edc509232569a4606f
- SHA512 3fca284e384abc95201dc73f19bd9d75413e8890e819967070b9d9991115be2a8c17e07bd1aaaffcbc770b393bf9a2af253100ac4d9efba8d21110bac97737fc
- SSDEEP 48:qlQOVagyAU3gJS+Tgc43uiu7Dh/gdp/gRfykVwv+:qa33gJS+ccQuiuJE/kyku
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Genieo\Application\TrayUi\bin\gentray.exe
- Size 550KB
- SHA256 41e09d91850d85cf97ba5cef2936cf9bda879595694b1457e27c9aecad1ac349
- MD5 7103eddedf089adaff84539585df19af
- SHA1 a4cbef70b9233956bcfeccff176ae971fb16b73e
- SHA512 38fd37ce6e3a72cd350dc6535222dffc011d0c66dfb09ce4adb3cb2ed1eb1834b7444172500e7e2062b8660b0c61925fbb2d249b5fced9166c7da7c49b93e191
- SSDEEP 12288:X1yFkepOza4J1k7/g/DP6eUbJn6uviTd8e:FynpV4J1S/YDPeJn6xTd8e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\bin\genupdater.exe
- Size 274KB
- SHA256 9f4a160ad96e6b2ebc8312a9d7883493bbeb474432565dedc33541f8758812eb
- MD5 986cc427326543cb6428895c9d18285f
- SHA1 29f9700c639df045b7959aada45654f27a200e1c
- SHA512 272d40369d636bb8753afce3336691014f8648601b466a73768f1b66da89b2b0ca23c6bcadd1a4d5e6069432b0a333cbb1e2d37005a08310ede655fa57ec6e4d
- SSDEEP 6144:AKoXP+/yLLYXcdwwvGgpiaWsrzxE/Ngba:AXXPsEsXGwngpi/YxE9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\conf\conf.ini
- Size 227B
- SHA256 9fa119137767b82d3f79ef819004b9a5288a9f244202cb43a07deb77a17fe260
- MD5 08e88b4716a7dc0a6530d85491d19736
- SHA1 f56f189e549770ad693a26cac7e4dfa1e628adf9
- SHA512 22573165e1a7952bbccc4f3e3df11581bdec3da26f36a253aed3896a1127174b6bc7855086bae191ace660757f69a8ca79ddbbcaf6b242ae4b1fb0155fa8e2f1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\uninstall\updater_uninstall.exe
- Size 71KB
- SHA256 2f43535d9f670760fbf5e47aaa15e019ba72e2ffc8ecb79f4db89ab8ce867335
- MD5 9c492d2dbc8f61f7bb6d8f49e2665222
- SHA1 1d8dfd0f61bf4adb1e23760ab5ceabf4db584800
- SHA512 dd090d999e87cad30138f1febb7e8c1a2f061f67c4c320d254894fabedddbb40791312854f47ed52a95c62754939c2ee33b84939f5edf1b32a698af93655fb80
- SSDEEP 1536:XQpQ5EP0ijnRTXJtTwksnntN+zUH5QsWHutL9GGhrA9W1cou5:XQIURTXJtTwkMr+zUH5BtOWK35
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Genieo\Data\log\Updater.log
- Size 4KB
- SHA256 df84954b701521fb3925070a3bc967bdb164a35e9fdf4566d7554228faa2e585
- MD5 cfc10b407aea647d6ab9395eec299fc1
- SHA1 30bcf6b7dd2ed254381a8113e81c51bd8ac55b31
- SHA512 6f16cd8fd9e4b0651e5130d412625a7b9211e107964a8aff1eb499b14f905225afec6664caddcdec6da95694faa7b77f04690ce8a8d0e6066f2fcc8f56b8b6e1
- SSDEEP 96:JP9AH15K1HNf93X5cHs2RHPVJ3/5IH9DmHxj73Ca:BwKdbMDuaF
- MD5 SHA1 SHA512 SSDEEP