smokeloader | d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c

Resubmissions

24-01-2025 23:30

250124-3hgcsatray 10

09-04-2024 08:35

09-04-2024 08:35

09-04-2024 08:35

09-04-2024 08:35

23-02-2024 00:53

22-02-2024 06:18

Analysis

max time kernel
273s
max time network
256s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
Size

141KB
MD5

3151d44dd03886e5f64f34481b116c81
SHA1

ebef87d5fd54925493385fbff5ba4d175c046fbc
SHA256

d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c
SHA512

6ebcb293583a6858a023bf71a347783b788064f9415421503155e2f87426ff52d7881f2a680331d4332e4062153901295f4b92771a1afd527624bb15230bbcc6
SSDEEP

3072:p13jvfNcgSRb5hPi9OTtA5HljuEa9ckZKD4Xxh:bTX2gSJL3t0HlyEa9cM

Score

10^/10

smokeloader backdoor discovery persistence trojan

Malware Config

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Smokeloader family
smokeloader

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File created	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File opened for modification	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File created	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File opened for modification	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File created	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe

Sets service image path in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCMON24\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCMON24.SYS"	Procmon64.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCMON24\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCMON24.SYS"	Procmon64.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCMON24\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCMON24.SYS"	Procmon64.exe

Executes dropped EXE 2 IoCs

pid	Process
2636	Procmon64.exe
2916	Procmon64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
668	1916	WerFault.exe	81
4928	3880	WerFault.exe	101

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Procmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Procmon.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	taskmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\DefaultIcon\ = "\"C:\\Users\\Admin\\Desktop\\Procmon64.exe\",0"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\shell\open\command	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\shell\open	Procmon64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Procmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\ = "ProcMon Log File"	Procmon64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Procmon.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\ = "ProcMon Log File"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\shell\open\command	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\.PML	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\Procmon.exe\" /OpenLog \"%1\""	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\DefaultIcon	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\.PML\ = "ProcMon.Logfile.1"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\shell	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\Procmon64.exe\" /OpenLog \"%1\""	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\ = "ProcMon Log File"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\.PML	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\DefaultIcon	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\DefaultIcon	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\DefaultIcon\ = "\"C:\\Users\\Admin\\Desktop\\Procmon.exe\",0"	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\.PML\ = "ProcMon.Logfile.1"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\shell\open\command	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\Procmon.exe\" /OpenLog \"%1\""	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\.PML\ = "ProcMon.Logfile.1"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\ProcMon.Logfile.1\DefaultIcon\ = "\"C:\\Users\\Admin\\Desktop\\Procmon.exe\",0"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\.PML	Procmon64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1180	taskmgr.exe
2332	Procmon64.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
2332	Procmon64.exe
2636	Procmon64.exe
2916	Procmon64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	1180	taskmgr.exe
Token: SeSystemProfilePrivilege	1180	taskmgr.exe
Token: SeCreateGlobalPrivilege	1180	taskmgr.exe
Token: SeDebugPrivilege	2332	Procmon64.exe
Token: SeLoadDriverPrivilege	2332	Procmon64.exe
Token: SeDebugPrivilege	2636	Procmon64.exe
Token: SeLoadDriverPrivilege	2636	Procmon64.exe
Token: SeDebugPrivilege	2916	Procmon64.exe
Token: SeLoadDriverPrivilege	2916	Procmon64.exe
Token: SeIncreaseQuotaPrivilege	4628	WMIC.exe
Token: SeSecurityPrivilege	4628	WMIC.exe
Token: SeTakeOwnershipPrivilege	4628	WMIC.exe
Token: SeLoadDriverPrivilege	4628	WMIC.exe
Token: SeSystemProfilePrivilege	4628	WMIC.exe
Token: SeSystemtimePrivilege	4628	WMIC.exe
Token: SeProfSingleProcessPrivilege	4628	WMIC.exe
Token: SeIncBasePriorityPrivilege	4628	WMIC.exe
Token: SeCreatePagefilePrivilege	4628	WMIC.exe
Token: SeBackupPrivilege	4628	WMIC.exe
Token: SeRestorePrivilege	4628	WMIC.exe
Token: SeShutdownPrivilege	4628	WMIC.exe
Token: SeDebugPrivilege	4628	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4628	WMIC.exe
Token: SeRemoteShutdownPrivilege	4628	WMIC.exe
Token: SeUndockPrivilege	4628	WMIC.exe
Token: SeManageVolumePrivilege	4628	WMIC.exe
Token: 33	4628	WMIC.exe
Token: 34	4628	WMIC.exe
Token: 35	4628	WMIC.exe
Token: 36	4628	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4628	WMIC.exe
Token: SeSecurityPrivilege	4628	WMIC.exe
Token: SeTakeOwnershipPrivilege	4628	WMIC.exe
Token: SeLoadDriverPrivilege	4628	WMIC.exe
Token: SeSystemProfilePrivilege	4628	WMIC.exe
Token: SeSystemtimePrivilege	4628	WMIC.exe
Token: SeProfSingleProcessPrivilege	4628	WMIC.exe
Token: SeIncBasePriorityPrivilege	4628	WMIC.exe
Token: SeCreatePagefilePrivilege	4628	WMIC.exe
Token: SeBackupPrivilege	4628	WMIC.exe
Token: SeRestorePrivilege	4628	WMIC.exe
Token: SeShutdownPrivilege	4628	WMIC.exe
Token: SeDebugPrivilege	4628	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4628	WMIC.exe
Token: SeRemoteShutdownPrivilege	4628	WMIC.exe
Token: SeUndockPrivilege	4628	WMIC.exe
Token: SeManageVolumePrivilege	4628	WMIC.exe
Token: 33	4628	WMIC.exe
Token: 34	4628	WMIC.exe
Token: 35	4628	WMIC.exe
Token: 36	4628	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe
1180	taskmgr.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2332	Procmon64.exe
2332	Procmon64.exe
2332	Procmon64.exe
2636	Procmon64.exe
2636	Procmon64.exe
2636	Procmon64.exe
2916	Procmon64.exe
2916	Procmon64.exe
2916	Procmon64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3120	3012	msedge.exe	107
PID 3012 wrote to memory of 3120	3012	msedge.exe	107
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 408	3012	msedge.exe	108
PID 3012 wrote to memory of 2244	3012	msedge.exe	109
PID 3012 wrote to memory of 2244	3012	msedge.exe	109
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110
PID 3012 wrote to memory of 1868	3012	msedge.exe	110

C:\Users\Admin\AppData\Local\Temp\d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
"C:\Users\Admin\AppData\Local\Temp\d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:1916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 460
  2⤵
  - Program crash
  PID:668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1916 -ip 1916
1⤵
PID:4496

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2636

C:\Users\Admin\AppData\Local\Temp\d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
"C:\Users\Admin\AppData\Local\Temp\d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:3880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 460
  2⤵
  - Program crash
  PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3880 -ip 3880
1⤵
PID:3540

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9a0a946f8,0x7ff9a0a94708,0x7ff9a0a94718
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12929058522765653350,11017496323209668819,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6124 /prefetch:2
  2⤵
  PID:4720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:668

C:\Users\Admin\Desktop\Procmon64.exe
"C:\Users\Admin\Desktop\Procmon64.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2332

C:\Users\Admin\Desktop\Procmon.exe
"C:\Users\Admin\Desktop\Procmon.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1236
- C:\Users\Admin\AppData\Local\Temp\Procmon64.exe
  "C:\Users\Admin\AppData\Local\Temp\Procmon64.exe" /originalpath "C:\Users\Admin\Desktop\Procmon.exe"
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2636

C:\Users\Admin\Desktop\Procmon.exe
"C:\Users\Admin\Desktop\Procmon.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4312
- C:\Users\Admin\AppData\Local\Temp\Procmon64.exe
  "C:\Users\Admin\AppData\Local\Temp\Procmon64.exe" /originalpath "C:\Users\Admin\Desktop\Procmon.exe"
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2916

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1536
- C:\Windows\System32\Wbem\WMIC.exe
  wmic bios get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26c380f7-89c6-49ec-9ef2-d0587899179d.tmp

Filesize
873B

MD5
65458cf3d8f9b473d4c887e3eace5583

SHA1
faba979e2444df15607c5ee0ca49e86d9a397871

SHA256
f5c3264f7740848364c0f3282f7c372c2f2e4a3dd09cfaa770dbde7434c3dc8d

SHA512
03a90bf6a01ad61c8a11041175ea52f2c239b78a1ff9a20788239876610f4b2a75cc955172961e06ac35e8ad26bbfb660e0cbac73bf9b23aa49caa820893e5d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
47KB

MD5
0d89f546ebdd5c3eaa275ff1f898174a

SHA1
339ab928a1a5699b3b0c74087baa3ea08ecd59f5

SHA256
939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e

SHA512
26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
70KB

MD5
3b06aa689e8bf1aed00d923a55cfdd49

SHA1
ca186701396ba24d747438e6de95397ed5014361

SHA256
cd1569510154d7fa83732ccf69e41e833421f4e5ec7f70a5353ad07940ec445c

SHA512
0422b94ec68439a172281605264dede7b987804b3acfdeeb86ca7b12249e0bd90e8e625f9549a9635165034b089d59861260bedf7676f9fa68c5b332123035ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
26KB

MD5
8ce06435dd74849daee31c8ab278ce07

SHA1
a8e754c3a39e0f1056044cbdb743a144bdf25564

SHA256
303074dab603456b6ed26e7e6e667d52c89ab16e6db5e6a9339205ce1f6c1709

SHA512
49e99bffcdf02cfe8cef0e8ef4b121c75d365ab0bbc67c3a3af4cf199cc46e27ab2a9fdf32590697b15b0a58ee2b7a433fe962455cf91f9a404e891e73a26f59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
47b7dd7249f791838cc00baefc307ee4

SHA1
bb902d0e6178e4d04e5178e63782473016f79a35

SHA256
077102c22673aeb738df2950f4d50753ff9ebe507e3a16c741d2e67b91ec4c3c

SHA512
13102003a078848426254a9b1a3e744f7da1922b637b9584f7ed99736601e940c33c089fdccce77e8eab582fa3e19a2b1282dd602e0d308967508fcb801a4c39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
881B

MD5
c7af02502b7aad75bbc72e6528d19fe3

SHA1
216ca21be43db6a452fff745d52ddb7cdc68d212

SHA256
e1d0cde1abcc7c898d770e7e173abb27b220c4d7c8b7f6ff6034fb573f4c6fc2

SHA512
b4457b0b38db4b7efef95200a3995cbe6cb8fcebb90d70747f2e5d311001372014359dd0ad6965819b35e69040d3e5795721ce388b8efec7fedf0d53e6a77b59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
881B

MD5
e7333c997eba7babc60c0fc9cc41d551

SHA1
085ce3f451a7e359568235e6df5a8ffa1a597c1f

SHA256
7f078a99d86ab846676285b56023cd99929c2fa1315be2638d318f7fbd83cc9e

SHA512
9dcd7c215b8855998b29d21d31ba8d632395581e375a15e8be1a3a81922ad56296a443feb9fff60bd9943c32cfab2b3407f74a524c14484349bd39cbdd8a30d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
69965ae2d1a3452a254a1f4b8f122024

SHA1
93f47e6860aaf21a42ab7983bc7ef76980e632a3

SHA256
4687f6e65eaf5ce91b465fed0d42d37dd999d04ff8c4d186e4c8981ddc513daf

SHA512
fa4ee8972b634af479ff075ef0542cf26d98389a974294311e0e652ea8d813ce0bf9e622ae2ffed20b1d012904902f2c9d88811d9996def2d9760701d756928c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
523e4fe2c5ec60197e15c88499c4a6c7

SHA1
69e1a9ea57af01a658d6c0fe3d18a792f278ef21

SHA256
5a32c27d5d65714295fa281bc9eed22e21e8a6abbe2e5aafe6a3e5db5b688c5c

SHA512
ee19d4dfaefb50cb753982006c07957208fe2391f010bb7c62ef40ac78e1415ae6d5ec20aeb4a47f40cd58a2fa3dea4051b0536b4842414065d87d68cdae3f6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
93f5e790051c5b62babba40ee887688d

SHA1
df154fe901c0ffb47830627b2fe6d3a9d585df4c

SHA256
5160a3ed2fd2383251a279c234aa6a636cfb3ea61051bcbe4566b9242c7da5a9

SHA512
985066ec3463ff6410e92ecbc6b6818920f23a957f0992423dad6648b175fec1ab05677674ff909fa447371edf59204e3409fec17e58bf7074f06ee403a4131f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c7e57fdc0d8607c1ca930a4a4007b4e7

SHA1
6789b62b2cd2513c09fe6ac5f0a5badb6e51b465

SHA256
c496977407ec204f090cc95000b4353712de6028fa99e228f9fb46787d7f2535

SHA512
c30e522f2445e7ea7cf2b2d3dc9bdfd8289b4681b10f032e06ea2b67c1bbb790744d018f0eee24618fe0f1c4247a552b62704fe87565a81f1361ffe1804ca1bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e7c2347221e0c138377eb873c6e3c14a

SHA1
c4e04176ccc6aadd074a991a87dd28fe8f8a35a0

SHA256
1e9f5739741ff0816c9a012d4c945988db01879402eda260a2f5e8a17f70cd83

SHA512
95ec77289dc9a7521820cc5a6bc805a29c9e5abce36fba868e545e7e57a72dc8bf03553b3dabec1c86dc44248cf7bd6d2987fb7e7d0448b6156de563b2605505

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
5192c1118a15daef4c177fce71b86d1c

SHA1
a91e16ecc2697fd3ecede1e9295e30fec0f12781

SHA256
dd3ecf384d876b2b288a3aaaa3a7a07e7e835a13c0f111533d1843335aec8e5a

SHA512
91180cad2f51502e1b3d5a39ede01e2c9805882cf64210eb8851e9d60475bcef242849bff1cff9acf4807545308681df7e7666665aa81a43dcc044699ea68cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
99be018eb0158fea60a31b58269f7a18

SHA1
633436c1b8e58a93e3e6b5ae4241a245177f245d

SHA256
787b84eacae1b0220a0e92d1860a6ec15259ef019ec056059ed23c165613a441

SHA512
50ea7a6a1e19d91c1a49a5598c2c2dd5470f51d9d7a76f5e608ac13dc87f3cdd4fcb3234a019e559ed21b8143e8329302b172d52887e24cb6949a282d0a5bacc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
a5ffedcf0fa8523b68a534537cfdd717

SHA1
71c15d0555f963cbcb619c5bd62e886b968f6e1a

SHA256
2fc22dfb78e9990d98a5a38258a789a25122ec0d74935999c09c5911c6741eb0

SHA512
7f651ed22d4830ecedd4456021859b986a7e33954f455d46be8ba22c6a7675b67275c2cc89f236d6416ade60438f2ea1e9b6755412fd07e499f064cea665d266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
90c6eabe1f1ca457066cea0a3aa1ead2

SHA1
cd6aef095e220d73b3be00aabff1c51e5804577e

SHA256
dbc21faffd82797028a8a53ad5780d9e2385d88d40a41f9b1b70d89b25c644fa

SHA512
e162ceb9d7f4a56c34be5f849efe8495a21174cf9d117764805aa94bd68b46b62d67dedce9fac28d0a53145439ae40edc7fdf030c1beceae3305d87ddfdc3260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a2348.TMP

Filesize
534B

MD5
f2c40b0d8bae0ea43f5d99a8c2d7844f

SHA1
db3e07bf58d8d21a94c5a50aeb93f68f7b8915b5

SHA256
992ed14ca070147cc9b6a82a8d75a9085f1ad349e489971f7a36523a8bb19c88

SHA512
22f75902e75afcb7bcf6c176a908e98d4e835ec060c1245f0cc5a9b93aca96bb4e6a64124084311a01f9fc47ebfc51a279dda80cbf08d6b3e0cb96db2ceb6ec5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
645177b06ddb2fbf79ab49aefe25f610

SHA1
e4fd6ed8045f715b6839fc8728045202409776e6

SHA256
c6cfa5f8eb26fcbab6e3aa915d6ad853b59a31026f36e3a3da867f8e10f92ecf

SHA512
d65199a18df1054f76b6d2e09fce598cdab2d2c842951ca1c15cebdc090941c70b451bc7b03b6a4bcb6a030ee1002e789b17fb541c5a5eb0a3c38594b7290c37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d095006f5861b63cac97bf6bc7fddcd7

SHA1
57818ca4b9a82b40c2d19ca731922eb6f0fded36

SHA256
677555a4fb05b060983c871b1eb892ad313b342e932cf789e3ba7d9028340b5e

SHA512
8d796983f8f1a135370716186f02f386a416e53040bd8d22a6aa1057d51153e4a39eae902273077a8e1a7f04c6d7d979f05b18abd51c1650c7db3f015d6a8755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ab9dffd7fdc46a14105b5a0da166408d

SHA1
0c289b25fea18b51f5b4a536f247b2b332ab6101

SHA256
af2c145f89ca7ab4735566dc6463b1f1ebe1bc588bddf80ddf0abac1acafaa1b

SHA512
bc3fd98a1571fe74904d9e3de951ec5bf6ff1829f1a3289f58b5e7d66ab5df091f6116d47ef51dd08b725ffa8d3c2c7f8ae5f31d9451dba44b0d40c653880e8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Procmon64.exe

Filesize
2.0MB

MD5
223b222ce387a7f446d49a1ee9b572bb

SHA1
8ed888a02861142e5eb576385568c2ba0ddd8589

SHA256
3e15995894f38b2eead95f7ff714585471f34f3af3d8f50a7f83344781502468

SHA512
037b4787af5fb129a3b1e0ac9565e59d5a55ef26ccf93bc9adf685c08422071ee0d0eb4667cd2ce0d725c7dea0209c1d7d48baf58cd18dfb58de35bf7feef1a2

Download Submit
C:\Users\Admin\Downloads\ProcessMonitor.zip

Filesize
2.9MB

MD5
213d09599b9761a8e78c20b3f8072636

SHA1
815ae249e5dc5bcdd8576ff29d3ec39e20c761f7

SHA256
d4ed579fdc1957fde0124dd41efd8d72af0529254984bfa5a3864ecd8b539252

SHA512
f656e128fcb0269946cfa03adc5392676c17b18f309e0476b2153fe545e4d92641e7849b94743e84fce39366b0b72f04e725b7922ccf513deaba8aef833ad971

Download Submit
memory/1180-21-0x0000020320F60000-0x0000020320F61000-memory.dmp

Filesize
4KB

Download
memory/1180-19-0x0000020320F60000-0x0000020320F61000-memory.dmp

Filesize
4KB

Download
memory/1180-23-0x0000020320F60000-0x0000020320F61000-memory.dmp

Filesize
4KB

Download
memory/1180-17-0x0000020320F60000-0x0000020320F61000-memory.dmp

Filesize
4KB

Download
memory/1180-13-0x0000020320F60000-0x0000020320F61000-memory.dmp

Filesize
4KB

Download
memory/1180-12-0x0000020320F60000-0x0000020320F61000-memory.dmp

Filesize
4KB

Download
memory/1180-20-0x0000020320F60000-0x0000020320F61000-memory.dmp

Filesize
4KB

Download
memory/1180-11-0x0000020320F60000-0x0000020320F61000-memory.dmp

Filesize
4KB

Download
memory/1180-18-0x0000020320F60000-0x0000020320F61000-memory.dmp

Filesize
4KB

Download
memory/1180-22-0x0000020320F60000-0x0000020320F61000-memory.dmp

Filesize
4KB

Download
memory/1916-4-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/1916-5-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1916-1-0x00000000009B0000-0x0000000000AB0000-memory.dmp

Filesize
1024KB

Download
memory/1916-6-0x0000000002550000-0x000000000255B000-memory.dmp

Filesize
44KB

Download
memory/1916-2-0x0000000002550000-0x000000000255B000-memory.dmp

Filesize
44KB

Download
memory/1916-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3880-8-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/3880-9-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download