floxif | 1fcd5d9317b5c6945085d314257e537583200e9a15227a513682337d5722655e

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-12-2024 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe
Size

14.4MB
MD5

7394131db0517873d7b3a88c634cf321
SHA1

0ba8e47cb1f98a1b3868c85f3e8c8b03b03186d7
SHA256

1fcd5d9317b5c6945085d314257e537583200e9a15227a513682337d5722655e
SHA512

efc1d71113f1a16d2c42adcff2c08e7d3b0b352df1e3b77571ec83f12ae5bd0616f0cae3621a676e8442c3dc39489065d0ac9f5ce30888095d7146ff2fce6b1e
SSDEEP

98304:8TstQIZETGdOfW0+bs0ZmjBjcaw2lsuze/iBXsLVMZHvOyGCPvPZsDByQNdXCd0I:8It30t0u/Zk2OXCd0LWkVgeXS7

Score

10^/10

floxif backdoor discovery trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000c000000023b2e-1.dat	floxif

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000c000000023b2e-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2772	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2772	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c000000023b2e-1.dat	upx
behavioral2/memory/2772-2-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/2772-51-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/2772-50-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/2772-84-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Toast.gom = "11000"	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 0f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 19000000010000001000000014d4b19434670e6dc091d154abb20edc030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f7e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000052135310639a10f77f886b229b9f7afc1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab553000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d0020004700320000000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa42000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2772	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe
2772	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe
3196	msedge.exe
3196	msedge.exe
1536	msedge.exe
1536	msedge.exe
3720	identity_helper.exe
3720	identity_helper.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2772	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
2772	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2772	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe
2772	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe
2772	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe
2772	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe
2772	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe
2772	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 1536	2772	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe	91
PID 2772 wrote to memory of 1536	2772	2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe	91
PID 1536 wrote to memory of 3708	1536	msedge.exe	92
PID 1536 wrote to memory of 3708	1536	msedge.exe	92
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 4336	1536	msedge.exe	93
PID 1536 wrote to memory of 3196	1536	msedge.exe	94
PID 1536 wrote to memory of 3196	1536	msedge.exe	94
PID 1536 wrote to memory of 4272	1536	msedge.exe	95
PID 1536 wrote to memory of 4272	1536	msedge.exe	95
PID 1536 wrote to memory of 4272	1536	msedge.exe	95
PID 1536 wrote to memory of 4272	1536	msedge.exe	95
PID 1536 wrote to memory of 4272	1536	msedge.exe	95
PID 1536 wrote to memory of 4272	1536	msedge.exe	95
PID 1536 wrote to memory of 4272	1536	msedge.exe	95
PID 1536 wrote to memory of 4272	1536	msedge.exe	95
PID 1536 wrote to memory of 4272	1536	msedge.exe	95
PID 1536 wrote to memory of 4272	1536	msedge.exe	95
PID 1536 wrote to memory of 4272	1536	msedge.exe	95
PID 1536 wrote to memory of 4272	1536	msedge.exe	95
PID 1536 wrote to memory of 4272	1536	msedge.exe	95
PID 1536 wrote to memory of 4272	1536	msedge.exe	95
PID 1536 wrote to memory of 4272	1536	msedge.exe	95
PID 1536 wrote to memory of 4272	1536	msedge.exe	95
PID 1536 wrote to memory of 4272	1536	msedge.exe	95
PID 1536 wrote to memory of 4272	1536	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-10_7394131db0517873d7b3a88c634cf321_bkransomware_floxif_hijackloader.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://playinfo.gomlab.com/ending_browser.gom?product=GOMPLAYER
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd4,0xfc,0x100,0xd8,0x104,0x7ffcc2ac46f8,0x7ffcc2ac4708,0x7ffcc2ac4718
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15075302162919943267,4435600882689856461,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,15075302162919943267,4435600882689856461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,15075302162919943267,4435600882689856461,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15075302162919943267,4435600882689856461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15075302162919943267,4435600882689856461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15075302162919943267,4435600882689856461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15075302162919943267,4435600882689856461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,15075302162919943267,4435600882689856461,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5072 /prefetch:8
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15075302162919943267,4435600882689856461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
    3⤵
    PID:780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15075302162919943267,4435600882689856461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15075302162919943267,4435600882689856461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15075302162919943267,4435600882689856461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15075302162919943267,4435600882689856461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15075302162919943267,4435600882689856461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
    3⤵
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15075302162919943267,4435600882689856461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15075302162919943267,4435600882689856461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
    3⤵
    PID:1312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15075302162919943267,4435600882689856461,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5588 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x540 0x4a4
1⤵
PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
38e130dadf02089d9750784f814835e3

SHA1
774c7431f35e83bf6b1f7bfea44d223754536c9b

SHA256
c90c3f32811f3a229b13f25b90dbd8f370126290bfef9f3db2930d8497109e02

SHA512
6b054b67c30af7c9ad8792f1a8777212a008e1205baf1a94ea1c8038b15948e61c251632c3c0ebd559f72c68cbd110e9588169b315c310aba412d61dec305323

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_kr.trip.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
fb2f610bac9de33c5137b00bb0bf5973

SHA1
46dd43b2f72adecb1b015d99786066154a8b0425

SHA256
64150b5996b7cf4198fb804b00e77f3b10c11bc20857cf7d65d603f1bafe7ec1

SHA512
35bebfcc938d7cd1426dad472c61022fcdc15188ea91b414dcc91f5ba3c5cc93c55de6a02ac6d9480a540112cb5575b69320bcdecd021b3300284dfda0f82855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
58bb7c120c8ce0c5239f43473f555234

SHA1
5c661ce59f31ca5556fa351ad0af039189603739

SHA256
f26cdac37061b3d7b72082a9fa16dbeb6818e3c6abe2183ba665ee80fc019c12

SHA512
fda9b2349114b926bbcccf37bbba715fc9ae413042bd783a1de409bce0cced9b6e4731858f1d97cd9e35effcc8820a0775957d02ebceeccc1aac23b496132658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
feb9d2a0e12ece24d7ca16dd2c65e1dd

SHA1
67823b5caa170e62010ac7921cd8052811d4ab62

SHA256
09cca178b8fce3268410e9a300a2eafa98aacbf3dcbd3f90c7b5644c20a53eee

SHA512
c081f6edc783fea2ce540f1da39c2d81cb4684a9dbb7a08580f0475c416e73635b6b80d66e6dd0bb250e76919e2c673fa0d13afb7d7614a5c68fc9e44747e323

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\9da23c324ecea68ba7f71d3f14f573ffcb5fc194\494a5f5f-c760-477d-ba67-0625abc20d97\index-dir\the-real-index

Filesize
72B

MD5
d780d50a2c0659407d4f3a8fb28838ff

SHA1
116720b678adcfffd032cfa1325f678edf770f48

SHA256
9796c81b8e80a2a357dcc613aaf04b792613b2914047ed2f164ce225d52bd9f3

SHA512
8bd125d9befb2ebabaf2cf89ed4a6fb5c33f990bc27c919a724ec0406f2291f37ffdfeafe230148da0e482966e907c8fa0de7199442c65820170c955a20de8ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\9da23c324ecea68ba7f71d3f14f573ffcb5fc194\494a5f5f-c760-477d-ba67-0625abc20d97\index-dir\the-real-index~RFe583544.TMP

Filesize
48B

MD5
8c642c56251750f80658c63f4b26e420

SHA1
e3b639822f6206ccf9b9fa9de70246b3abadc933

SHA256
677d0ebf41d21fb2675167a0a5325aed27c927d693c935c73cb782d99244fb7d

SHA512
467d27331b71a1c0e0d1bf3302e87645c58aedc61d9406df4c6ffaf4cd01a0161b8f34b339fe4b5b7ad444095f5a3625777d606c938fba36c663fc39a2371f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\9da23c324ecea68ba7f71d3f14f573ffcb5fc194\index.txt

Filesize
117B

MD5
80f41802fd77a3280216455332b5ae49

SHA1
4d8a401beb983729540f168f9347eea2ac86e4b4

SHA256
10e7424c85ea7f7c78e8203d733ef6399a4cdf6501608f2bb0633dc00c5953cc

SHA512
677732c6bfa32c7c02a2213a25a0d9b5245058ecc9eef820dae9eccde6168fefb96a0d84670ebd7b8b086819e210783b9b9983f862faa493dc32c2a4c0951902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\9da23c324ecea68ba7f71d3f14f573ffcb5fc194\index.txt

Filesize
112B

MD5
c4ae9fd4832721619c8040ede2c81545

SHA1
31d96af10a265cf5eee8c6d5f11b58916991fd3e

SHA256
c8727292ec8ad1e7f2b0e2dc4c9309db3163022306fb3c1ae72602145cdf6dce

SHA512
5b394660804004cc7dd608c14c93733d19c929a25639d89545987980b0690e4d7a3109eb9ad9fc7b0e4c03dff1a8058baa9fd879386e4b3c4ff7e7bece0c05ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
2a781f32746dc63dfab8befeb806bab9

SHA1
4bc2c34d2af454de742b8977a338d6d0b8fd0959

SHA256
2d17776557d0172f225d9d3015d4be821608d84506006cc695eef72852997db2

SHA512
76685aa065db23239e70e7354ed138bf8c709ef8a33ea3c345a3aa7df283a2229873ebbff0a238da522f139647a1a53b2e6d4953692f7a34e5c0afca15bc28e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583515.TMP

Filesize
48B

MD5
dc5d0baa03c2c65be1fd779a9adb62b1

SHA1
9b203d36c7e939719273dfaa6c4588760ad3e421

SHA256
263f1978fe5b030b9109353e0708bcddeb36ae7fe107443c8e3df5a87da64883

SHA512
052bf8ccc7beaa3061448809773fcdd18ddeeb75ab066a04b0e96ec06130cce845777b9b48d89b5d2191957175dea05babb7cf00bb82da0064524a689ada8688

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8cdc519585c260a759c0480e39c4eaa8

SHA1
b2f7bdabb8e9245e95217a9f82f038f3f1309a26

SHA256
fafea8400052c7bf501c2784aa1dd521a5c19b652c0abe9b3a3b5f0dea8fc929

SHA512
db15c00ee4b5b4d1fe9e847d0bd90f7c7791da73e105f86c0a13608761c2410a9d7196e8599fe9b112d38a2fec75c1a606622c4cf0307eb622d7cde9eb4c5e7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\A1D26E2\95F698CAD4.tmp

Filesize
14.3MB

MD5
7740b91aa5877cd86117db93dc5b0426

SHA1
b02a401b86aaa41768a15e4f027dccb812341fb7

SHA256
44df3a987ad432ea7942d8923dd2a8e29f3204119274ace5b0c5181838557564

SHA512
88890d8956872c8369ed2b3ede2349ae7021a770182dc3904f1ed983ae006355067d294abd0c5d77fc40c20cbad9e33e76bb29fd4d778f11079926bbc58e810f

Download Submit
memory/2772-2-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2772-49-0x00000000006A0000-0x0000000001514000-memory.dmp

Filesize
14.5MB

Download
memory/2772-82-0x00000000006A0000-0x0000000001514000-memory.dmp

Filesize
14.5MB

Download
memory/2772-84-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2772-51-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2772-50-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download