Overview

overview

10

Static

static

7

0332f856f8...fe.exe

windows7-x64

10

0332f856f8...fe.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250211-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-02-2025 16:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe

  • Size

    10.9MB

  • MD5

    f7e1cfc6c7f7ff4dd762af36588cda54

  • SHA1

    583e0bfed1a770d4d60fcdb3ed9abe701b7f0f49

  • SHA256

    0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe

  • SHA512

    77f775a2a001a2cbf2146d1c0200f158a7217cf96bc796678b3d1879f0705115239c72c5530cbf930aed57eed18080c7d7dfb784e3d17799f9578cd911530820

  • SSDEEP

    196608:y0I9SsDPwSQZmqFcfpckEi3+9Yq2AyqRZ6VkdLko5pxK13gmli:y0I9HDPwjZ3FAbEdm1qRdlWBgmli

Score
10/10
xredadwarebackdoordiscoverypersistenceprivilege_escalationstealerupxvmprotect

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 28 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe
    "C:\Users\Admin\AppData\Local\Temp\0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Users\Admin\AppData\Local\Temp\csrss1.exe
      C:\Users\Admin\AppData\Local\Temp\csrss1.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4456
      • C:\Users\Admin\AppData\Local\Temp\._cache_csrss1.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_csrss1.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3572
        • C:\Users\Admin\AppData\Local\Temp\WinStore.Ap.exe
          C:\Users\Admin\AppData\Local\Temp\WinStore.Ap.exe
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:4424
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 1404
          4⤵
          • Program crash
          PID:4200
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1848
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1644
          • C:\Users\Admin\AppData\Local\Temp\WinStore.Ap.exe
            C:\Users\Admin\AppData\Local\Temp\WinStore.Ap.exe
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:4608
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 1324
            5⤵
            • Program crash
            PID:2576
    • C:\Users\Admin\AppData\Local\Temp\csrss2.exe
      C:\Users\Admin\AppData\Local\Temp\csrss2.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:4948
    • C:\Users\Admin\AppData\Local\Temp\csrss3.exe
      C:\Users\Admin\AppData\Local\Temp\csrss3.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Users\Admin\AppData\Local\Temp\._cache_csrss3.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_csrss3.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:464
  • C:\Windows\svchost.exe
    C:\Windows\svchost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3892
    • C:\Windows\svchost.exe
      C:\Windows\svchost.exe Win7
      2⤵
      • Executes dropped EXE
      PID:4980
    • C:\Windows\svchost.exe
      C:\Windows\svchost.exe Win7
      2⤵
      • Executes dropped EXE
      PID:1980
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 408
      2⤵
      • Program crash
      PID:3160
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3892 -ip 3892
    1⤵
      PID:1164
    • C:\Windows\svchost.exe
      C:\Windows\svchost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4348
      • C:\Windows\svchost.exe
        C:\Windows\svchost.exe Win7
        2⤵
        • Executes dropped EXE
        PID:2816
      • C:\Windows\svchost.exe
        C:\Windows\svchost.exe Win7
        2⤵
        • Executes dropped EXE
        PID:3920
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 368
        2⤵
        • Program crash
        PID:4036
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1084
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4348 -ip 4348
      1⤵
        PID:2872
      • C:\Windows\svchost.exe
        C:\Windows\svchost.exe
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2064
        • C:\Windows\svchost.exe
          C:\Windows\svchost.exe Win7
          2⤵
          • Executes dropped EXE
          PID:3132
        • C:\Windows\svchost.exe
          C:\Windows\svchost.exe Win7
          2⤵
          • Executes dropped EXE
          PID:4836
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 332
          2⤵
          • Program crash
          PID:3700
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2064 -ip 2064
        1⤵
          PID:3116
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1644 -ip 1644
          1⤵
            PID:440
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3572 -ip 3572
            1⤵
              PID:1868
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Qzc2OEMyMTctQzc2Mi00RDc2LUE3QTgtMjdDOUY5N0U0NTg1fSIgdXNlcmlkPSJ7NjJCNEJGOEItNzEwMS00MEJDLTk5MTctRUJDRTEzRjNBNEEyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QUNENTg1OEYtQUU0Qi00REUwLUI4OEEtQUM0NkU5M0EwRjVDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI2IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODIxNjkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1MzE4NTEwMTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjQxODQ4NjYyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
              1⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:1744
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3902C35C-C63A-4274-87F1-F7CDEC8DF86A}\MicrosoftEdge_X64_133.0.3065.69.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3902C35C-C63A-4274-87F1-F7CDEC8DF86A}\MicrosoftEdge_X64_133.0.3065.69.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:3624
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3902C35C-C63A-4274-87F1-F7CDEC8DF86A}\EDGEMITMP_6FD88.tmp\setup.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3902C35C-C63A-4274-87F1-F7CDEC8DF86A}\EDGEMITMP_6FD88.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3902C35C-C63A-4274-87F1-F7CDEC8DF86A}\MicrosoftEdge_X64_133.0.3065.69.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                2⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Installs/modifies Browser Helper Object
                • Drops file in Program Files directory
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:4372
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3902C35C-C63A-4274-87F1-F7CDEC8DF86A}\EDGEMITMP_6FD88.tmp\setup.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3902C35C-C63A-4274-87F1-F7CDEC8DF86A}\EDGEMITMP_6FD88.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3902C35C-C63A-4274-87F1-F7CDEC8DF86A}\EDGEMITMP_6FD88.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff62d7a6a68,0x7ff62d7a6a74,0x7ff62d7a6a80
                  3⤵
                  • Executes dropped EXE
                  PID:3592
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3902C35C-C63A-4274-87F1-F7CDEC8DF86A}\EDGEMITMP_6FD88.tmp\setup.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3902C35C-C63A-4274-87F1-F7CDEC8DF86A}\EDGEMITMP_6FD88.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                  3⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:4136
                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3902C35C-C63A-4274-87F1-F7CDEC8DF86A}\EDGEMITMP_6FD88.tmp\setup.exe
                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3902C35C-C63A-4274-87F1-F7CDEC8DF86A}\EDGEMITMP_6FD88.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3902C35C-C63A-4274-87F1-F7CDEC8DF86A}\EDGEMITMP_6FD88.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff62d7a6a68,0x7ff62d7a6a74,0x7ff62d7a6a80
                    4⤵
                    • Executes dropped EXE
                    PID:4544
                • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
                  3⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:5036
                  • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7a5926a68,0x7ff7a5926a74,0x7ff7a5926a80
                    4⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    PID:4596
                • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:4460
                  • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7a5926a68,0x7ff7a5926a74,0x7ff7a5926a80
                    4⤵
                    • Executes dropped EXE
                    PID:1476
                • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
                  3⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of WriteProcessMemory
                  PID:4312
                  • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7a5926a68,0x7ff7a5926a74,0x7ff7a5926a80
                    4⤵
                    • Executes dropped EXE
                    PID:2592
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
              1⤵
                PID:456
              • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
                "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4368
              • C:\Windows\system32\wwahost.exe
                "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
                1⤵
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:1744

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Persistence

              Boot or Logon Autostart Execution

              2
              T1547

              Active Setup

              1
              T1547.014

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Browser Extensions

              1
              T1176

              Event Triggered Execution

              1
              T1546

              Component Object Model Hijacking

              1
              T1546.015

              Privilege Escalation

              Boot or Logon Autostart Execution

              2
              T1547

              Active Setup

              1
              T1547.014

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Component Object Model Hijacking

              1
              T1546.015

              Defense Evasion

              Modify Registry

              5
              T1112

              Credential Access

              Discovery

              Query Registry

              5
              T1012

              System Information Discovery

              4
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Configuration Discovery

              1
              T1016

              Internet Connection Discovery

              1
              T1016.001

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3902C35C-C63A-4274-87F1-F7CDEC8DF86A}\EDGEMITMP_6FD88.tmp\setup.exe
                Filesize

                6.8MB

                MD5

                bdb1aecedc15fc82a63083452dad45c2

                SHA1

                a074fcd78665ff90ee3e50ffcccad5f6c3e7ddcb

                SHA256

                4ea0907c3fc2c2f6a4259002312671c82e008846d49957bb3b9915612e35b99f

                SHA512

                50909640c2957fc35dd5bcac3b51797aa5daa2fb95364e69df95d3577482e13f0c36a70ae098959cb9c2aaeb4cfe43025c1d8d55b5f8858b474bcb702609749d

                Download Submit

              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                Filesize

                3.9MB

                MD5

                4aaa893417cccc147989f876c6a7b295

                SHA1

                b1e35c83518bb275924ead0cd6206bf0c982d30f

                SHA256

                2c38e3c3f18e2d3fb7f04336356b9b5186cabe06b3343beec318ef0def1a9eeb

                SHA512

                109e0c88977fae65a4950fc38393ca32a70d68ef41aeb75b28e6566e0fa626e32e31be38308e7ed5b6a8ba1f56fb5f2133a07aa8bb643224c3dbb089ce9cfd0e

                Download Submit

              • C:\Program Files\msedge_installer.log
                Filesize

                72KB

                MD5

                398ab3fb95ccff745f3760f941529c50

                SHA1

                60957fd9cc0911c26f257a9b693703c9a0c7c237

                SHA256

                5ac5ae309d05c10fcd3229f3e66be22d99008d2d37ad15b75765e8aec3e6e6cb

                SHA512

                0b47d116d32c2787ed305997a9f36d5ab5c5c7aad4d4850a8ab5bb1d73f69e1eb9e6efd30abebb257cabdce00261300713287bc2332141852ff9b9a028a7a35d

                Download Submit

              • C:\Program Files\msedge_installer.log
                Filesize

                98KB

                MD5

                b727d544dca3d5d0eb57228b3ca51d77

                SHA1

                ec69115a519be0d73a52e76fa1611d772398e8b0

                SHA256

                978b724e593ff9218b84885335f0432a84f436839983e9e8565fe1c80d6779a4

                SHA512

                be4f5430bec267c559b0b72c077c3ff57989d3846ad4d16aac117ff13d9d16225b6837738381e600a89121a9364891abbd4a0019523500abe5ea0212831bd3f3

                Download Submit

              • C:\Program Files\msedge_installer.log
                Filesize

                101KB

                MD5

                c227be23353ceab33b2a2ae80e152312

                SHA1

                4dd626b39df2e9a896e29e9e89c925b433b79f8e

                SHA256

                9978262fecdd64e3a18b8957a957db8c5e7223a0df32993268d09faea6b8966f

                SHA512

                0d5d1194d42509f1031810b113e4941debe9946696328fcbb7f4e9778beab297397200bdb676aa34b6510db3928d0314ca9276b18164c1737463f9d5fa1c53ee

                Download Submit

              • C:\Program Files\msedge_installer.log
                Filesize

                103KB

                MD5

                69105b00b90a83a18a8c2d706507b38d

                SHA1

                2d0e71ca05067cd87d7bdf8f8dc97d0bbeea62ce

                SHA256

                52b04504fbe4629f110a29713874342f2912e49f9c75408e81b0f7a6d1131b63

                SHA512

                07c955f275cbaf9c0d6f858fc424c4c2932d68f4be68e683a15815f57e6f535e20554d3655394f888db0c7d23d90a3544e428f9e970e32da5228dc5325845ab2

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\._cache_csrss1.exe
                Filesize

                5.0MB

                MD5

                044d17f97d75da98e9eb2aa62ec7b75a

                SHA1

                0115b76acb7424b55252416f5f96dfcbd8575c17

                SHA256

                d9161c71e9aa4ed4cbe22b6fda94e18c85b43125fc5cee102daa0db5f9b60a34

                SHA512

                f3e3d0ec861a0ee5aedf45b2d05c0a4de4cece59ce7c848e1294885a22409a8d88ab045c52606a4bd60585d7ac8ec084b200886f518cafb691eb0333385f2200

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\._cache_csrss3.exe
                Filesize

                700KB

                MD5

                e90eddc4db34ec03b80c552e53b5c69c

                SHA1

                885cff8c7f6fcc362332dcaec0beadb73ea28eba

                SHA256

                7e7825184c8bd575fac683ee957fc530100de3399e22d611d12ddf155d62e336

                SHA512

                3e9fae21e9a528072fc8add9bb3bd8a2f6183fc4375beebe05e4ae0383cfc4619dbd1061737eeea439caea1f9bb81dab1cf9c5b887077024b8d92bb1a5807095

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\9C085E00
                Filesize

                22KB

                MD5

                7735132295fb840b69c6e3c5d2496ddc

                SHA1

                704ae738beca1fe98d13e0138be2b3c55a1c9652

                SHA256

                a98a904025135edaf51a198f93bff6def1cadcc092a1745e80628048346e8ae2

                SHA512

                cfa4b780e7eb540601e527beba291e2fd8f581cb2f178507a561ea11ffffdfb0c6d0fb4d001bd9071a5b951d6a1257a236590d213c021278176d522a3277f5f2

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\WinStore.Ap.exe
                Filesize

                36KB

                MD5

                6bcfc02cec27994f21fbd864eab7cced

                SHA1

                941469f26107f8e5576943b8a6f1338a2a0694b8

                SHA256

                aac2fcb25f1022e52ca001f655c50e94f59b8cb1447a3a89b31f5b51b1c1cbc3

                SHA512

                1988fe89ccd35335927ec444b6d0c178d28198f3270bb12bad89fc5a9e70527a5a03b9c7c89330dc7dafc141d2156eb2795288454c74c9a8c8e0abcdd5378fc9

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\csrss1.exe
                Filesize

                5.1MB

                MD5

                f33b166aa53dcbdb6ee38dbc041ed51b

                SHA1

                fd77e28afa1008b7a2d43191fea2a42bbab37df2

                SHA256

                aa5fe8561ad9325981bd6f514c25b8a15571120638fb37ad6e151b8f4defe135

                SHA512

                8f3a82e3921796c092c31b1e7aefa15776b277810f5248bb39988af7cb1576aafc974e9046a2defa5f2e959269f4dbcba8244afc67463348afc8c66a675cf619

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\csrss3.exe
                Filesize

                1.4MB

                MD5

                948ef47cbef691ed14da3dd81fd12d99

                SHA1

                3d495e706c9456d76d19013cb89ff87c874f2e8e

                SHA256

                ef700e93e37470b99acbcd35e450bf63f03b19a362d3821350c62abacd6c9d54

                SHA512

                9f0b5268794f4b168fb6ae0197a1f56acba6d9820f295cc24947354b8cece0dadfca0f5f7967f607f578125de39232a801e17c6f1f14b35288c98c16d6a37d62

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\kqmmQHtY.xlsm
                Filesize

                17KB

                MD5

                e566fc53051035e1e6fd0ed1823de0f9

                SHA1

                00bc96c48b98676ecd67e81a6f1d7754e4156044

                SHA256

                8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

                SHA512

                a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

                Download Submit

              • C:\Windows\svchost.exe
                Filesize

                36KB

                MD5

                1c47934968624092ab9d889aa6c42f89

                SHA1

                6371c0b5bf568225e637a9049d3b7b2888e7ec1f

                SHA256

                ee8f0bab814a672f624ed59f157806229cc194aaf3704aea7f49e6f5fd70c0b0

                SHA512

                d35c84a17e29d401a563dfa7b9b0c56d3a266a5bdc00dc85ee2e35b44931639c4b1ddd08ef178797144086fa3a09c3daad35340e0c99217f06adfdecc069752c

                Download Submit

              • memory/464-308-0x0000000000400000-0x00000000004C2000-memory.dmp

                Filesize

                776KB

                Download

              • memory/464-411-0x0000000000400000-0x00000000004C2000-memory.dmp

                Filesize

                776KB

                Download

              • memory/1084-247-0x00007FFB82F30000-0x00007FFB82F40000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1084-246-0x00007FFB82F30000-0x00007FFB82F40000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1084-310-0x00007FFB805D0000-0x00007FFB805E0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1084-297-0x00007FFB805D0000-0x00007FFB805E0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1084-244-0x00007FFB82F30000-0x00007FFB82F40000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1084-248-0x00007FFB82F30000-0x00007FFB82F40000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1084-245-0x00007FFB82F30000-0x00007FFB82F40000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1644-315-0x0000000002770000-0x0000000002771000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1644-316-0x0000000002780000-0x0000000002781000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1644-311-0x0000000000A20000-0x0000000000A21000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1644-312-0x0000000000A30000-0x0000000000A31000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1644-313-0x0000000002720000-0x0000000002721000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1644-314-0x0000000002750000-0x0000000002751000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1644-321-0x00000000027E0000-0x00000000027EB000-memory.dmp

                Filesize

                44KB

                Download

              • memory/1644-320-0x00000000027B0000-0x00000000027CE000-memory.dmp

                Filesize

                120KB

                Download

              • memory/1644-318-0x0000000010000000-0x0000000010891000-memory.dmp

                Filesize

                8.6MB

                Download

              • memory/1848-410-0x0000000000400000-0x00000000009E4000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1848-392-0x0000000000400000-0x00000000009E4000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1848-380-0x0000000000400000-0x00000000009E4000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1848-152-0x0000000000400000-0x00000000009E4000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1944-309-0x0000000000400000-0x0000000000571000-memory.dmp

                Filesize

                1.4MB

                Download

              • memory/2976-379-0x0000000000400000-0x000000000194F000-memory.dmp

                Filesize

                21.3MB

                Download

              • memory/2976-7-0x0000000003720000-0x0000000003721000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2976-6-0x0000000003710000-0x0000000003711000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2976-5-0x0000000003700000-0x0000000003701000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2976-4-0x00000000036F0000-0x00000000036F1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2976-2-0x0000000001AC0000-0x0000000001AC1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2976-3-0x0000000001BE0000-0x0000000001BE1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2976-1-0x0000000001AA0000-0x0000000001AA1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2976-0-0x0000000000B3C000-0x0000000000E6B000-memory.dmp

                Filesize

                3.2MB

                Download

              • memory/2976-11-0x0000000000400000-0x000000000194F000-memory.dmp

                Filesize

                21.3MB

                Download

              • memory/2976-333-0x0000000000B3C000-0x0000000000E6B000-memory.dmp

                Filesize

                3.2MB

                Download

              • memory/2976-14-0x0000000000400000-0x000000000194F000-memory.dmp

                Filesize

                21.3MB

                Download

              • memory/3572-216-0x0000000002800000-0x0000000002801000-memory.dmp

                Filesize

                4KB

                Download

              • memory/3572-219-0x0000000010000000-0x0000000010891000-memory.dmp

                Filesize

                8.6MB

                Download

              • memory/3572-153-0x0000000010000000-0x0000000010891000-memory.dmp

                Filesize

                8.6MB

                Download

              • memory/3572-214-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/3572-223-0x0000000002870000-0x000000000287B000-memory.dmp

                Filesize

                44KB

                Download

              • memory/3572-215-0x00000000027F0000-0x00000000027F1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/3572-212-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/3572-222-0x0000000002840000-0x000000000285E000-memory.dmp

                Filesize

                120KB

                Download

              • memory/3572-213-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/3572-217-0x0000000002810000-0x0000000002811000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4368-490-0x0000020C01380000-0x0000020C01388000-memory.dmp

                Filesize

                32KB

                Download

              • memory/4368-491-0x0000020C01600000-0x0000020C01849000-memory.dmp

                Filesize

                2.3MB

                Download

              • memory/4368-488-0x0000020BE5E40000-0x0000020BE5E4E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/4368-489-0x0000020C01350000-0x0000020C0135A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/4456-28-0x0000000000400000-0x00000000009E4000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/4456-151-0x0000000000400000-0x00000000009E4000-memory.dmp

                Filesize

                5.9MB

                Download