floxif | hxxps://tria[.]ge/dashboard

Resubmissions

08-01-2025 12:33

250108-pq9seasmaj 10

08-01-2025 12:30

250108-ppx28asldl 10

Analysis

max time kernel
91s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
08-01-2025 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tria.ge/dashboard

Score

10^/10

floxif backdoor defense_evasion discovery trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x0003000000000687-564.dat	floxif

Downloads MZ/PE file

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0003000000000687-564.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
5960	Floxif.exe
776	Floxif.exe

Loads dropped DLL 2 IoCs

pid	Process
5960	Floxif.exe
776	Floxif.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
48	raw.githubusercontent.com

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0003000000000687-564.dat	upx
behavioral1/memory/5960-567-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/5960-570-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/776-574-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/776-577-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	Floxif.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Floxif.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3516	5960	WerFault.exe	109
132	776	WerFault.exe	115

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 631610.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Floxif.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5632	msedge.exe
5632	msedge.exe
872	msedge.exe
872	msedge.exe
1668	identity_helper.exe
1668	identity_helper.exe
4876	msedge.exe
4876	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5960	Floxif.exe
Token: SeDebugPrivilege	776	Floxif.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 5380	872	msedge.exe	77
PID 872 wrote to memory of 5380	872	msedge.exe	77
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5376	872	msedge.exe	78
PID 872 wrote to memory of 5632	872	msedge.exe	79
PID 872 wrote to memory of 5632	872	msedge.exe	79
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80
PID 872 wrote to memory of 5852	872	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://tria.ge/dashboard
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd34fa3cb8,0x7ffd34fa3cc8,0x7ffd34fa3cd8
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2568 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1884,16871730001623120712,9621443062651626976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6112

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3328

C:\Users\Admin\Desktop\Floxif.exe
"C:\Users\Admin\Desktop\Floxif.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 456
  2⤵
  - Program crash
  PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5960 -ip 5960
1⤵
PID:1752

C:\Users\Admin\Desktop\Floxif.exe
"C:\Users\Admin\Desktop\Floxif.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 424
  2⤵
  - Program crash
  PID:132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 776 -ip 776
1⤵
PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
72KB

MD5
ccf7e487353602c57e2e743d047aca36

SHA1
99f66919152d67a882685a41b7130af5f7703888

SHA256
eaf76e5f1a438478ecf7b678744da34e9d9e5038b128f0c595672ee1dbbfd914

SHA512
dde0366658082b142faa6487245bfc8b8942605f0ede65d12f8c368ff3673ca18e416a4bf132c4bee5be43e94aef0531be2008746c24f1e6b2f294a63ab1486c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
9fe3426ef966d8ac7b428d39d2b75ccd

SHA1
1297fe6e3ec3153ff63b2dab7feef74ff77bd116

SHA256
79ffed2ed68e6cc1eea6186695c19f50ee28040c8f46a6d7d4884ebde7c940a5

SHA512
d320322e60635c2ad37968217bb7c36fc527309ad83c453735aa0c7b00046a8e1ac37f9c5e462b7db156ae735824fe092f6e27d522f7966ad612725e022253a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cd3aea17b2ef10a9c8b33aa7d8868dfa

SHA1
652cfe6f0c166f3322b90121842d1c87639f8ed8

SHA256
ee87581aa96372963aa16f37ccfbbb24578357ee28caf6bc23b9ea7fc8513876

SHA512
9957cb540d26a55861eaa6fb2937e6e16215488fd52eda03f9f998605de2f1fafce6e6ae08508058e1a75525e2b7fcb151a8c864d6853162612d460b26a4ef05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0141a9e35a4613c4cdc2896149855065

SHA1
5a18b6139ea7aa65312e24a7445f16600f26504f

SHA256
3b52390a1d67e99edbe47c5be6924e7fa4cb83a7e1d1014d6c29b00385294ef4

SHA512
0c5d8c4c31ee5fe9f4a849a9b6f6cdc28d8147666f0add94615f7662b0dd4953c661d7a510630fcf88a76b9e33fc3546f3098a6e8818f6f6a45326390250979f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7040e6d5c0765c26cb72384e9dc82f56

SHA1
38d59eaafc7b0dc41cfc6d1edbb6abe00722841f

SHA256
ae33668983299d4f32bb9f987af404044527e6c4865d65c0e0dc7e9a7b65aa46

SHA512
e408dfee618ca31d13157c14b5469e4fd23552ec45b951ed67d8868136ce89c553c87919917bfef9eb8e26f92d26d827f9680b9fcdf8662cd55486cc4c5173af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bd61257e3012475960908f55b32ab99e

SHA1
a5bb515fc67f5e308670aada1ca8f2b3918978f9

SHA256
ef12bfe2508d5d5f90a37cd2f13e91dcfde006d1eb79505076ad483bd629a9a9

SHA512
a56b481ae8494c3376d2879476a9468a6e19c422a91b3b6200a6d1f04fd2edb9b2e874a9743c88eae13b2d7b6298bec6fbc8b815af0bb2ae7465b12f19e12c47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f2da877f7876117bc2a7b67aae5b4ef8

SHA1
8c761d5b9f3bfafba3dcd78076c878e0e8fd1991

SHA256
e26acef11e1c880a0d9f682eb9e5c11df78ba2392d7d9559b8bcebd4a16887d4

SHA512
c28418b18adafb66cb6b7a2c6cbd0b47ae2cf32234c7a95dad8507719954e593f9a5a82f4857f93f52ef70f52b6480ec293a4efb3fb3aba3aaef4e5fef96af97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
17495749d8c3b5cfe4c4be16c88e72f1

SHA1
6b40a6f2a4e242050e79d9d3669c945a3e279c46

SHA256
8033f5ae443fc90820a3ff4eeaf4c4a348fa5db660279abe7818ec3546cecccc

SHA512
307be5b2cad4fcacdc1e9ef3f6a46b9f0a7ca3ed53b32c40553f85cc9d9bc5435819010a650bfb9a8b329647cbb15269857efc19a990abfdc8b5e7b20a557c8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f1180bf3169fd66fe7f6dd482bd343ee

SHA1
748681fc6a6151e619e42f5e1e166bfdffcbb983

SHA256
385b65d422c7846f61d7231c81adeb7f0b627d71accd4a1a67fe3ad9ee1179f3

SHA512
ff0a29f8cd990e388a62a7c91095c95c6034c0cc6ba3cd37e33342f6f489cc0a89557eef2b2ed91e93b9a8cf71ca41ae006a9fef347ae9caa912eb207a31568a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fd39d77b332b059d8293a0d6df53c330

SHA1
36b87cfa8c93cb6dd1d229f889417f6431bb1b6b

SHA256
ba3024a970155db6697fd1b2bc25af54bc23e398f39d739ccac82a9ce4934d93

SHA512
3768a7ec0bba693af31a0fbae1c4e2925ca68bb379b88e3f91e9ee8413e1eadbd6332f8ef438a8d7248a0be1a89b8d1642ac9abbfda932fe1ac0aca185cf5704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581018.TMP

Filesize
367B

MD5
5d6159b45c2e3b6c5f62e4d19a860bbd

SHA1
ee052987ab1e9619a2b7b07fc8fd84efa68b5fea

SHA256
e37160e1f7b8db646d0d77abf7e48c9d29a5b815218ad467fd7b8faa48b85af1

SHA512
6c19c6664aee9734948565da953065cd91b1732914001984db10ef7158774ce037ad7f35aca0ed353e6d066bb5dfd843d7a8edaf4ca5710e68e5c40db1837990

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
492f318186f322d8eea4457ec41f8570

SHA1
7d918cedf738d8f59800019ac1f0e7124143c084

SHA256
c4afb208e2620b30b08e8cf14f75454ca70d286fc3e31bc0994e0fe0e23583d2

SHA512
c1cb2431d5367dd1d1b1c8dddc86cc5ae3b445128a1d91014a1a832f4307cc058379d5049e90be541a1eb97f37261cf69d993095b76a7fae633cccb3d0a0b005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e94c48b5d2f7277a1df8e1b1442bd440

SHA1
54a44fdf2166b0fdc9fa5bca55eff6ca86833c6b

SHA256
e4ab7b2417eeec9207539f334d091260b1139b2020309256253b8fc2d08d4834

SHA512
218ccf31927832e280747becd576a8d7c852de4f203337341a5231126faeee905983af3f70e4fc2cf645192f562da9a3b29c9a2c596a23e3f4746fb5b9dd455b

Download Submit
C:\Users\Admin\Downloads\Floxif.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 631610.crdownload

Filesize
532KB

MD5
00add4a97311b2b8b6264674335caab6

SHA1
3688de985909cc9f9fa6e0a4f2e43d986fe6d0ec

SHA256
812af0ec9e1dfd8f48b47fd148bafe6eecb42d0a304bc0e4539750dd23820a7f

SHA512
aaf5dae929e6b5809b77b6a79ab833e548b66fb628afeb20b554d678947494a6804cb3d59bf6bbcb2b14cede1a0609aa41f8e7fe8a7999d578e8b7af7144cb70

Download Submit
memory/776-574-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/776-575-0x0000000000E10000-0x0000000000E85000-memory.dmp

Filesize
468KB

Download
memory/776-577-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5960-567-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5960-570-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5960-569-0x0000000000E10000-0x0000000000E85000-memory.dmp

Filesize
468KB

Download