floxif | 5a650596a18ba8f2b37eb09613542fe857f7d717e374dbe970c976933d38a38d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe
Size

14.4MB
MD5

b1cd90e9fe382f483aabfebed44f75de
SHA1

0a7b2ea127c40968aa4802b46ddcbcb8985c68c1
SHA256

5a650596a18ba8f2b37eb09613542fe857f7d717e374dbe970c976933d38a38d
SHA512

54e04e524e12a8d589ea329dfaf79d8431256e07b62173a6731e5d0d0f46af5b7694bcd27420e7247d095a671498e0a0f40091a18b17af19624f2282f9654a7f
SSDEEP

98304:8TxtQIZETGdOfW0+bs0ZmjBjcaw2lsuze/iBXsLVMZHvOyGCPvPZZDByQNdXCd07:8Xt30t0u/Zk25XCd0LWkVgeXS8

Score

10^/10

floxif backdoor discovery phishing trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000b000000023b5b-1.dat	floxif

A potential corporate email address has been identified in the URL: [email protected]
phishing

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000b000000023b5b-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
4824	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4824	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b000000023b5b-1.dat	upx
behavioral2/memory/4824-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4824-51-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4824-64-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Toast.gom = "11000"	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 0f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 19000000010000001000000014d4b19434670e6dc091d154abb20edc030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f7e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000052135310639a10f77f886b229b9f7afc1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab553000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d0020004700320000000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa42000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4824	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe
4824	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe
4584	msedge.exe
4584	msedge.exe
3328	msedge.exe
3328	msedge.exe
4140	identity_helper.exe
4140	identity_helper.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4824	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
4824	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4824	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe
4824	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe
4824	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe
4824	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe
4824	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe
4824	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 3328	4824	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe	87
PID 4824 wrote to memory of 3328	4824	2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe	87
PID 3328 wrote to memory of 3212	3328	msedge.exe	88
PID 3328 wrote to memory of 3212	3328	msedge.exe	88
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 904	3328	msedge.exe	89
PID 3328 wrote to memory of 4584	3328	msedge.exe	90
PID 3328 wrote to memory of 4584	3328	msedge.exe	90
PID 3328 wrote to memory of 2912	3328	msedge.exe	91
PID 3328 wrote to memory of 2912	3328	msedge.exe	91
PID 3328 wrote to memory of 2912	3328	msedge.exe	91
PID 3328 wrote to memory of 2912	3328	msedge.exe	91
PID 3328 wrote to memory of 2912	3328	msedge.exe	91
PID 3328 wrote to memory of 2912	3328	msedge.exe	91
PID 3328 wrote to memory of 2912	3328	msedge.exe	91
PID 3328 wrote to memory of 2912	3328	msedge.exe	91
PID 3328 wrote to memory of 2912	3328	msedge.exe	91
PID 3328 wrote to memory of 2912	3328	msedge.exe	91
PID 3328 wrote to memory of 2912	3328	msedge.exe	91
PID 3328 wrote to memory of 2912	3328	msedge.exe	91
PID 3328 wrote to memory of 2912	3328	msedge.exe	91
PID 3328 wrote to memory of 2912	3328	msedge.exe	91
PID 3328 wrote to memory of 2912	3328	msedge.exe	91
PID 3328 wrote to memory of 2912	3328	msedge.exe	91
PID 3328 wrote to memory of 2912	3328	msedge.exe	91
PID 3328 wrote to memory of 2912	3328	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-17_b1cd90e9fe382f483aabfebed44f75de_bkransomware_floxif_hijackloader.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://playinfo.gomlab.com/ending_browser.gom?product=GOMPLAYER
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff80b3a46f8,0x7ff80b3a4708,0x7ff80b3a4718
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10461873849133439692,10165564638509269207,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,10461873849133439692,10165564638509269207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,10461873849133439692,10165564638509269207,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10461873849133439692,10165564638509269207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10461873849133439692,10165564638509269207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
    3⤵
    PID:2604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10461873849133439692,10165564638509269207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10461873849133439692,10165564638509269207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10461873849133439692,10165564638509269207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
    3⤵
    PID:1376
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,10461873849133439692,10165564638509269207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6360 /prefetch:8
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,10461873849133439692,10165564638509269207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6360 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10461873849133439692,10165564638509269207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10461873849133439692,10165564638509269207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10461873849133439692,10165564638509269207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10461873849133439692,10165564638509269207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10461873849133439692,10165564638509269207,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\57ba897b-0c23-4c93-a2db-91b13dd88b61.tmp

Filesize
10KB

MD5
301f5f0d19804e01656d82300ccf4ab1

SHA1
8bec67c5b7f645514270a10ea56144ff6fe40339

SHA256
cb6462173abcab2881990c95231067b2fd9cd4be28c741cbff00806524011a03

SHA512
0b37b51cd8ef3645637a2fe0b7e5b76301034397bf82569e03656da819fe33fee81b2564835627a28e22d5f8d183bfdc4ae11ec7fffa5fb01ca4b588a2b03a2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
71be60cf1efc3939fe936ce36d058f86

SHA1
814f5edb4fb9ea62244bf209b9e5fbde3db395ff

SHA256
41ed785937fa6288799ad38f5b6ce110325a982e66459d7fc44214ee16462d86

SHA512
53ce7cf0d46d20429eeecf7e250fa05fd3162578b4f84119c4f3df03cf7bbd827eef641314a8d05d22542659d9e8df3af3fc97a603d53b20bed5194975debb7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
41f461dae05551180c90736fa7e8f4ad

SHA1
63b279cda1274970cb6890dd9c9f9ceafab866f7

SHA256
a21e78db901b030cc78515f7f5dd9fa1a87f07e468e09d07362024f0b99cebdb

SHA512
b9b9c4fea52d92b59a00643e151fece7fbe84e94ce3123e60b56e01335e6f138ae625505060f3eb188d47d4a193b7add00b09313de41d3dd9196c6480ad3cf0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
2f91b712eb667c01abdfd8175a3e7390

SHA1
1b5173b12e7a8b2046f49b2a44d160b58f7319f5

SHA256
0cae38eff40131adad4d0edcad53d24ac59bf560ca4e5b6d2cd760f749d30d05

SHA512
ef9391d3d225bb7a53f34220440433f47b2b4f08176ddb20997b5cfc7b0afe1e71b850f4d0ccfc205f3878834bfbe10a2909f3d0592b82f3372836ea82b8c29a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eccddd775b4b0b3af1add15ec521feba

SHA1
79c50ea785358446df2e942c2d99698f270314f3

SHA256
80ac106c23164713a7888d30ecec25e6ead8fc6f143eed74006e99a892d54b69

SHA512
d9558efed8c9ac4614bd19369ba3148ea439e691c4ceb1c6769257390cb7cb5c53d227cfb43cd4b26c7e70a911655d9f1a2eb1eef537d5425c1a690dda38166b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
84241612907a3f3380c0daba1fa33c1e

SHA1
a28dc8dca73e6f56ad033d067730d9ff46e699a2

SHA256
500dbdd5d45c21c84634c0bb5f0b53c6b956cae12f2b1916e6522467535c78c0

SHA512
f9be2af7dc9c5f568dbf1b37294d5a65b40fa4c1806bfcde9e2121a1d317adeef0fa5f772022a237cc6922163c8b3c4f2ad32a4524ef3d6c4907adc9b4a4c43d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5801d0.TMP

Filesize
48B

MD5
cfdf47ef01158d69e2f1633cc3347d9f

SHA1
cb767be1282890aa2ac9e8e53ae33583ff0693bb

SHA256
188dfa854fc3a857a93ce5eff86ab6b1bdae9680e68121a6e1a4c508b4af6b04

SHA512
2505c18eb579d368f0086af808d6a61b5f73cf2e0beb5eb13622e8a3f85eec73cddee663161efec6376b1e2f6723ede89b1fedcb128fe525b09c742a6ae3b286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Temp\A1D26E2\7678E2412D8.tmp

Filesize
14.3MB

MD5
7740b91aa5877cd86117db93dc5b0426

SHA1
b02a401b86aaa41768a15e4f027dccb812341fb7

SHA256
44df3a987ad432ea7942d8923dd2a8e29f3204119274ace5b0c5181838557564

SHA512
88890d8956872c8369ed2b3ede2349ae7021a770182dc3904f1ed983ae006355067d294abd0c5d77fc40c20cbad9e33e76bb29fd4d778f11079926bbc58e810f

Download Submit
memory/4824-62-0x0000000000660000-0x00000000014D4000-memory.dmp

Filesize
14.5MB

Download
memory/4824-64-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4824-49-0x0000000000660000-0x00000000014D4000-memory.dmp

Filesize
14.5MB

Download
memory/4824-51-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4824-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download