floxif | 9882d6299dbf72f54b9c4ebab591176f41c46d27a16009dc853ad8361931258f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2024 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe
Size

14.4MB
MD5

55b322fb7b471824b829dbc851598f79
SHA1

3c2262c5415b05876845e1552ce014a565cf1c68
SHA256

9882d6299dbf72f54b9c4ebab591176f41c46d27a16009dc853ad8361931258f
SHA512

81246ab755237cd0ab453255c5a89ab49eb6180348b0d565f8dfb69b1acb7110beb303bcd63a57f4c124147090f36b097279bc1e411950e9114b123e679ade1a
SSDEEP

98304:8TDtQIZETGdOfW0+bs0ZmjBjcaw2lsuze/iBXsLVMZHvOyGCPvPZcDByQNdXCd0G:8Vt30t0u/Zk2eXCd0LWkVgeXSp

Score

10^/10

floxif backdoor discovery persistence phishing privilege_escalation trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000a000000023caf-1.dat	floxif

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010
A potential corporate email address has been identified in the URL: [email protected]
phishing

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000a000000023caf-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
968	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
968	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023caf-1.dat	upx
behavioral2/memory/968-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/968-51-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/968-64-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Toast.gom = "11000"	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 0f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 19000000010000001000000014d4b19434670e6dc091d154abb20edc030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f7e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000052135310639a10f77f886b229b9f7afc1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab553000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d0020004700320000000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa42000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
968	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe
968	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe
3612	msedge.exe
3612	msedge.exe
3644	msedge.exe
3644	msedge.exe
1596	identity_helper.exe
1596	identity_helper.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	968	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
968	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
968	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
968	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe
968	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe
968	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe
968	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe
968	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe
968	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 3644	968	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe	97
PID 968 wrote to memory of 3644	968	2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe	97
PID 3644 wrote to memory of 4388	3644	msedge.exe	98
PID 3644 wrote to memory of 4388	3644	msedge.exe	98
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 4652	3644	msedge.exe	99
PID 3644 wrote to memory of 3612	3644	msedge.exe	100
PID 3644 wrote to memory of 3612	3644	msedge.exe	100
PID 3644 wrote to memory of 4596	3644	msedge.exe	101
PID 3644 wrote to memory of 4596	3644	msedge.exe	101
PID 3644 wrote to memory of 4596	3644	msedge.exe	101
PID 3644 wrote to memory of 4596	3644	msedge.exe	101
PID 3644 wrote to memory of 4596	3644	msedge.exe	101
PID 3644 wrote to memory of 4596	3644	msedge.exe	101
PID 3644 wrote to memory of 4596	3644	msedge.exe	101
PID 3644 wrote to memory of 4596	3644	msedge.exe	101
PID 3644 wrote to memory of 4596	3644	msedge.exe	101
PID 3644 wrote to memory of 4596	3644	msedge.exe	101
PID 3644 wrote to memory of 4596	3644	msedge.exe	101
PID 3644 wrote to memory of 4596	3644	msedge.exe	101
PID 3644 wrote to memory of 4596	3644	msedge.exe	101
PID 3644 wrote to memory of 4596	3644	msedge.exe	101
PID 3644 wrote to memory of 4596	3644	msedge.exe	101
PID 3644 wrote to memory of 4596	3644	msedge.exe	101
PID 3644 wrote to memory of 4596	3644	msedge.exe	101
PID 3644 wrote to memory of 4596	3644	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-28_55b322fb7b471824b829dbc851598f79_bkransomware_floxif_hijackloader.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://playinfo.gomlab.com/ending_browser.gom?product=GOMPLAYER
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffabf9446f8,0x7ffabf944708,0x7ffabf944718
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16169641999601321123,12644821947226973660,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,16169641999601321123,12644821947226973660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,16169641999601321123,12644821947226973660,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16169641999601321123,12644821947226973660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16169641999601321123,12644821947226973660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16169641999601321123,12644821947226973660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
    3⤵
    PID:524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16169641999601321123,12644821947226973660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16169641999601321123,12644821947226973660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,16169641999601321123,12644821947226973660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:8
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,16169641999601321123,12644821947226973660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16169641999601321123,12644821947226973660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16169641999601321123,12644821947226973660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16169641999601321123,12644821947226973660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
    3⤵
    PID:3828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16169641999601321123,12644821947226973660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16169641999601321123,12644821947226973660,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4144 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7e0aad07-4bef-4538-b62e-9dbe8a6a9e0a.tmp

Filesize
10KB

MD5
7e5a0d7f6199fe6fac07badd639e6483

SHA1
138e8c906be2a97adf0f61bc430839d44762a3c0

SHA256
8f1c20ade6236e0d7c29a108de8b35e9808ab5ddb840d329cb3730a5d700cbbc

SHA512
706eccb4bf675c919e9d4f31189d8487924b5804421e82da725ff2f327bc2561da9310093d34c4ef6888c731e299521e786683a2ea5b35686e9e4ba47055ff71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
864B

MD5
03a626c7a25c8161f18ea63c01c79374

SHA1
cf0f3121e0e64a41e108375c6c29bb82fb25187b

SHA256
ec3e55a5e9372decab0a9cff623fb0378df7246fbc3967219446c44963640b3b

SHA512
ae33dfdf1c51bea20e82dc7e011ee6ef3c58b43f912d0861371c8eeb32aa861ad8ef2d2c5c89b20dd05c48e9a11ee4fed972426f50fb0c36791c9d82c9b06be0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
7db41ae90e4703347b04b4d122e0b0f2

SHA1
c5067e25f28c28eb39a9298bd0eef522f3ee3c64

SHA256
da6d826fa8c6bf912955289817a4fb5a4b177dbebc3e5946e2450d55f5f7b6a5

SHA512
a4fddfaf949ab92e7f70d62b9cd3c3c40b21d3a19035cfd10d5fc21a37c53584227e4b79866698e074b7611d2422a4a9330f6c497a49bb83c1643f74570e2d96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
09120334221f17f025af5c7f2ecb1aff

SHA1
53212fe8cd5ab58ef4370f003753a6bdb8fe80ab

SHA256
d751832bf8c00ba5c14d87633407a60de4495036de485318062895ac7d0e5e9b

SHA512
cd5812891c86bc7214a12888f047f558ee9e87801c9fe4fb432a1aea9ccd409f820e0440a55239fae0acdb78d2bd23dc45c1e91ca95a530f6b67d87596f45c09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
c58673f74522a074a4cd10cddb8637e8

SHA1
55e7ba4fab6d48766cfe02dc6cb7e5fa45ae0a99

SHA256
aa4fcd2b99f49f7ae5657ef81b6fc73915add3543c6565376276a920249bef1d

SHA512
c32dd3b61cc46aa4d16cee3eabee103981c485d34c9a9c0532e04d53e5cdefea8e37857dfb545aa2a7d2012d3b9a057e8482e36faa0b6df0eeed17d03a6ba78f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
71ec118eded4c52c3f1daf2baf2e9778

SHA1
869ff7b969def4a773c45206030d116c04a85b1e

SHA256
82836061e95eeedc02a86f660f5ea9b1e995577a92317423de67ae13899832df

SHA512
18950dc051a20cf051459db5bcd7ce26dc90e3931d4d6ffeebb90406c5f71dae9b23ec779e574feaf8bbcd45104d4eb216fcaf42e3a7ca5b05d76b60e732217e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
4c9ee8074e19f8a82886622d63ed095e

SHA1
cef204479f3a733d959fe150949974bdbef2f339

SHA256
ea43f3143931f8be5871643299f4c34c775fd6bf96629659e34a3a8e05b64547

SHA512
c0d4fceaebc37b9d0e9d5ded78f516822cd7e7c63267576c5d436429b69f535218b5fca069bffe45e344606f9fe75495bc3c1f254b81366322551ae52742d16b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582556.TMP

Filesize
48B

MD5
e0b211dd05b94b85a0d8556b647b052c

SHA1
618aa914c7a77f2bd3614642e02c91d440ff69ec

SHA256
865d1eb472cc605dffc7eed1a35ee45e06a53de7e010ada65118983948de8ef9

SHA512
eb39f7d7cd3edd53e34ff98a80c4bf6e808a1504d3ccf8e540ea21d7fefa80be8c56657bcde309acdf5691d15d95163abb7939b65017d3ddd7fee317d7086c85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Temp\A1D26E2\9AB9C703C8.tmp

Filesize
14.3MB

MD5
7740b91aa5877cd86117db93dc5b0426

SHA1
b02a401b86aaa41768a15e4f027dccb812341fb7

SHA256
44df3a987ad432ea7942d8923dd2a8e29f3204119274ace5b0c5181838557564

SHA512
88890d8956872c8369ed2b3ede2349ae7021a770182dc3904f1ed983ae006355067d294abd0c5d77fc40c20cbad9e33e76bb29fd4d778f11079926bbc58e810f

Download Submit
memory/968-64-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/968-62-0x0000000000400000-0x0000000001274000-memory.dmp

Filesize
14.5MB

Download
memory/968-49-0x0000000000400000-0x0000000001274000-memory.dmp

Filesize
14.5MB

Download
memory/968-51-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/968-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download