bdaejec | dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78

Analysis

max time kernel
142s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2024 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78.exe
Size

1.4MB
MD5

0ec7425d2a0ff149d89db3e0347debe3
SHA1

80d229945b6267b85528e1d2c29615c66a5e04fa
SHA256

dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78
SHA512

4dfa00e8690ab894c5b806810296399032ad5e65f764632fc2ad4aeda72c5d91140701117084e80fc4c95d13fcde79d8c09e71b770c751ab71e89def9cebd76f
SSDEEP

24576:3NBIc0OQms+rYW6eRrRBKkuKgt10f+3ggrTmCmclq14:AViYW6+1ck/gte+QMmCmclqO

Score

10^/10

bdaejec aspackv2 backdoor discovery

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral2/memory/5072-57-0x0000000000070000-0x0000000000079000-memory.dmp	family_bdaejec_backdoor

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0007000000023ccc-35.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	xJX.exe

Executes dropped EXE 2 IoCs

pid	Process
532	Autopatch.exe
5072	xJX.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	xJX.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	xJX.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	xJX.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	xJX.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	xJX.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	xJX.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	xJX.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	xJX.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	xJX.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	xJX.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Autopatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xJX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe
4452	msedge.exe
4452	msedge.exe
3848	identity_helper.exe
3848	identity_helper.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
532	Autopatch.exe
532	Autopatch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 532	3548	dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78.exe	85
PID 3548 wrote to memory of 532	3548	dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78.exe	85
PID 3548 wrote to memory of 532	3548	dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78.exe	85
PID 532 wrote to memory of 5072	532	Autopatch.exe	87
PID 532 wrote to memory of 5072	532	Autopatch.exe	87
PID 532 wrote to memory of 5072	532	Autopatch.exe	87
PID 532 wrote to memory of 4452	532	Autopatch.exe	97
PID 532 wrote to memory of 4452	532	Autopatch.exe	97
PID 4452 wrote to memory of 3692	4452	msedge.exe	98
PID 4452 wrote to memory of 3692	4452	msedge.exe	98
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 1804	4452	msedge.exe	99
PID 4452 wrote to memory of 3148	4452	msedge.exe	100
PID 4452 wrote to memory of 3148	4452	msedge.exe	100
PID 4452 wrote to memory of 4536	4452	msedge.exe	101
PID 4452 wrote to memory of 4536	4452	msedge.exe	101
PID 4452 wrote to memory of 4536	4452	msedge.exe	101
PID 4452 wrote to memory of 4536	4452	msedge.exe	101
PID 4452 wrote to memory of 4536	4452	msedge.exe	101
PID 4452 wrote to memory of 4536	4452	msedge.exe	101
PID 4452 wrote to memory of 4536	4452	msedge.exe	101
PID 4452 wrote to memory of 4536	4452	msedge.exe	101
PID 4452 wrote to memory of 4536	4452	msedge.exe	101
PID 4452 wrote to memory of 4536	4452	msedge.exe	101
PID 4452 wrote to memory of 4536	4452	msedge.exe	101
PID 4452 wrote to memory of 4536	4452	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78.exe
"C:\Users\Admin\AppData\Local\Temp\dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Users\Admin\AppData\Local\Temp\Autopatch.exe
  "C:\Users\Admin\AppData\Local\Temp\Autopatch.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Users\Admin\AppData\Local\Temp\xJX.exe
    C:\Users\Admin\AppData\Local\Temp\xJX.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:5072
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\72b23f98.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://universal-eo.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff821b246f8,0x7ff821b24708,0x7ff821b24718
      4⤵
      PID:3692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9663673481848256084,16417595799155918631,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
      4⤵
      PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,9663673481848256084,16417595799155918631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,9663673481848256084,16417595799155918631,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9663673481848256084,16417595799155918631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9663673481848256084,16417595799155918631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9663673481848256084,16417595799155918631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9663673481848256084,16417595799155918631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9663673481848256084,16417595799155918631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 /prefetch:8
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9663673481848256084,16417595799155918631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9663673481848256084,16417595799155918631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9663673481848256084,16417595799155918631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9663673481848256084,16417595799155918631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9663673481848256084,16417595799155918631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
      4⤵
      PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9663673481848256084,16417595799155918631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1912 /prefetch:1
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9663673481848256084,16417595799155918631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
      4⤵
      PID:532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9663673481848256084,16417595799155918631,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5580 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
095f9349b7ec651a3daff6a598f32869

SHA1
563404e41188bde2835dae8e68bd4d9c3752db95

SHA256
8ea09f9efc42a46158cba717ded0effea3169b31d247e15e14f05c2b7ff0e8f1

SHA512
fc93f56793aeffd32cdf91444dddd88ea31d7bcc51fc4d3a3251660f6b3b46b4ea3527bf1890e4682559f6b73190b79f3c6ca88aa21f62e7af7792421b05a97d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3b4dc6eba51f95768cbb47ac6aa474c1

SHA1
60f8a3d35f2bf0442846c8e0ef9ef61932c94493

SHA256
894932e8b4d55865b0be2b78c660caf74af030eb4aef705c1e9b8e30e8205c04

SHA512
a8a4fa9116e7b20573e46732c86f3e71e6cd21ee513dc2c9897087444054c6da4963b8567b7f2a345dfa9b8b83b40b61bb5c669b69817345da9bd24987198c6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4d3476bb7f2e11d8a6e8d5d59b96df7a

SHA1
3d7bbd7fe932259cc498759498bcf1552aae6ae0

SHA256
948c37130eb1aaef6dfa04a0858a682b6d24e6c21eb39f847a7629f0c61baa30

SHA512
fcbe22d15f915406ec7f6122ecdf8f84413beeecc54550f516d301d87b53d759aab46fe3cbabcf5b4581e41a9b70e603849ee7bebb0b72eb9d76bb9eb0d39960

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P2UT3MS5\k2[1].rar

Filesize
4B

MD5
d3b07384d113edec49eaa6238ad5ff00

SHA1
f1d2d2f924e986ac86fdf7b36c94bcdf32beec15

SHA256
b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c

SHA512
0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\72b23f98.bat

Filesize
181B

MD5
245d9502e302f12c4bb11a2e1b7493f1

SHA1
0b61fd5163008b8ebece29e560192437adf375d9

SHA256
a86bd11715c20c743667dcef21e78924163974b0f0acf5ec5ecbbe1363254748

SHA512
750057508afb8758affc1aa894ecfa356cc39ea7d28fc9a67921d2c08fef98499f7c37939243e6dcfffc654e05ba82ba58bc8bfa4a8a0b819be3a840156855af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7F7140CF.exe

Filesize
4B

MD5
20879c987e2f9a916e578386d499f629

SHA1
c7b33ddcc42361fdb847036fc07e880b81935d5d

SHA256
9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

SHA512
bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

Download Submit
C:\Users\Admin\AppData\Local\Temp\AutoPatch.exe

Filesize
300KB

MD5
408e41d45388acb3738c3835eaf22c4c

SHA1
3690d22dd9b81421597edc15deb49a31526d068f

SHA256
593f678aa71743d0d916efa39de9a15ab433089cad3dd117dfb32d455fba3d6d

SHA512
5e8bfd82e7bde251be33a2f47fe91eb6ee612b64712f8477c3ae094df669229aef9bc5b512aeda5e70e7d42bb3bf383253dbb5eadb20c489d6aa63b3bbe1b887

Download Submit
C:\Users\Admin\AppData\Local\Temp\AutoPatch\SocketConfig.ini

Filesize
305B

MD5
01e1951ce818d30a9adddf5e45f03cfd

SHA1
cabde24499cacedb8ff7550594a33af27c6f6b58

SHA256
64c55e6463bbc2749fb3a90dae13cde53bbee051986abfd2a24952ab5438887b

SHA512
c07795604e759c6c09442fd0a6725d4764604a2559bea57b79094d004cd871024a89581bb3cca182c2297e6aebcd987e5ba2aeb20dcd234a207c3f480684e47c

Download Submit
C:\Users\Admin\AppData\Local\Temp\AutoPatch\Update.log

Filesize
2KB

MD5
cd61ca85044ea843240a2884bcf22b93

SHA1
b83b474116e72a725663680aa504afa6c6eee7d1

SHA256
57613ccec51a5d1305848054940fc50a3edba857cf681f0fb09eab143c8958bb

SHA512
c0d52d1c861c7f0d2cfd0f5e0b6eea9ede9893d92186a470f5164d6bc4d788f90272c2ebe5146c9a478516e796908dba632d6cd161d6c8d75fc8138aab9204fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\AutoPatch\config.ini

Filesize
1KB

MD5
325a3fe9191c18e85653de016928f26a

SHA1
8db59795dfa79d07baf89289c72ee777d799ee26

SHA256
8440e1ec82043b66430a5b7aade340ff7570aef3ee6d8b2c05394d824dc79903

SHA512
bedf4af818cb70c8349be13167d02b1d3120bb9796bb96b2a757484dd5c9dc6e82352543761c7010b3a941a85e77ed8dd8a2a7ab8e36da55f728c1d980ea6594

Download Submit
C:\Users\Admin\AppData\Local\Temp\version.dat

Filesize
4B

MD5
fba9d88164f3e2d9109ee770223212a0

SHA1
a5b1d7e217aa227d5b2b8a84920780cf637960e2

SHA256
b281bc2c616cb3c3a097215fdc9397ae87e6e06b156cc34e656be7a1a9ce8839

SHA512
59963bfd1fef9ea453959517c8755d00cfa0d7c57f112404f3ca9def63986c149d9aabb28ccb225b5a3470e42a170141558d6d6b87ff104931c754fad0d5c933

Download Submit
C:\Users\Admin\AppData\Local\Temp\xJX.exe

Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
memory/532-66-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/532-56-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/532-31-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/5072-57-0x0000000000070000-0x0000000000079000-memory.dmp

Filesize
36KB

Download
memory/5072-36-0x0000000000070000-0x0000000000079000-memory.dmp

Filesize
36KB

Download