floxif | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

max time kernel
132s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2025, 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

floxif backdoor discovery trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x000a000000023d7c-420.dat	floxif

Downloads MZ/PE file 2 IoCs

flow	pid	Process
69	3972	msedge.exe
69	3972	msedge.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000a000000023d7c-420.dat	acprotect

Executes dropped EXE 3 IoCs

pid	Process
5232	Mabezat.exe
5944	Floxif.exe
6104	Floxif.exe

Loads dropped DLL 2 IoCs

pid	Process
5944	Floxif.exe
6104	Floxif.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
68	raw.githubusercontent.com
69	raw.githubusercontent.com

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a000000023d7c-420.dat	upx
behavioral1/memory/5944-423-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/5944-427-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/6104-442-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/6104-445-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	Floxif.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2344	5944	WerFault.exe	135
4780	6104	WerFault.exe	140

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mabezat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 288927.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 443300.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 696604.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
4240	msedge.exe
4240	msedge.exe
3052	identity_helper.exe
3052	identity_helper.exe
2492	msedge.exe
2492	msedge.exe
5184	msedge.exe
5184	msedge.exe
1216	msedge.exe
1216	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5944	Floxif.exe
Token: SeDebugPrivilege	6104	Floxif.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 4676	4240	msedge.exe	84
PID 4240 wrote to memory of 4676	4240	msedge.exe	84
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 4856	4240	msedge.exe	85
PID 4240 wrote to memory of 3972	4240	msedge.exe	86
PID 4240 wrote to memory of 3972	4240	msedge.exe	86
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87
PID 4240 wrote to memory of 1260	4240	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9d3646f8,0x7ffb9d364708,0x7ffb9d364718
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1912 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2244 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9541403366758773089,13266452530467892275,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5624 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2192

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3696

C:\Users\Admin\Downloads\Mabezat.exe
"C:\Users\Admin\Downloads\Mabezat.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5232

C:\Users\Admin\Downloads\Floxif.exe
"C:\Users\Admin\Downloads\Floxif.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 432
  2⤵
  - Program crash
  PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5944 -ip 5944
1⤵
PID:3324

C:\Users\Admin\Downloads\Floxif.exe
"C:\Users\Admin\Downloads\Floxif.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 400
  2⤵
  - Program crash
  PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6104 -ip 6104
1⤵
PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
72KB

MD5
ccf7e487353602c57e2e743d047aca36

SHA1
99f66919152d67a882685a41b7130af5f7703888

SHA256
eaf76e5f1a438478ecf7b678744da34e9d9e5038b128f0c595672ee1dbbfd914

SHA512
dde0366658082b142faa6487245bfc8b8942605f0ede65d12f8c368ff3673ca18e416a4bf132c4bee5be43e94aef0531be2008746c24f1e6b2f294a63ab1486c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c9b7e612ef21ee665c70534d72524b0

SHA1
e76e22880ffa7d643933bf09544ceb23573d5add

SHA256
a64366387921aba157bba7472244791d5368aef8ecaf6472b616e1e130d7d05e

SHA512
e195e1ce5e7c06d193aa1f924d0079ea72b66eb22c3aea5b6811172251768f649368734e817996d9f0f72ddfd0e2bf2454aaee0bc650eaffd56fa125a334ae88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f4a0b24e1ad3a25fc9435eb63195e60

SHA1
052b5a37605d7e0e27d8b47bf162a000850196cd

SHA256
7d70a8fc286520712421636b563e9ee32335bca9a5be764544a084c77ddd5feb

SHA512
70897560b30f7885745fede85def923fb9a4f63820e351247d5dcbe81daab9dab49c1db03b29c390f58b3907d5025737a84fff026af2372c3233bc585dcfd284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
93874d92b4f81de094e4822af8bc3f11

SHA1
542d93d43c32fbbf58fcb31ee5b0392a426f6859

SHA256
e1bc32b5ad119339964fec503897af9e827592763590d668962d4c78acabe3e5

SHA512
f0879696e915efd88f694e7e99b118432b06a01e430db5b82e3214c92be10fa7ef4ac1a87ebcb54728f51bea799be99d50a83207efb676dc5c79e96e9cc26116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
eaa41e447d34ee9c6bea6cf1ecc64ebd

SHA1
a2a47395a06103cdcd85d3f247fd3b55bbc44d3b

SHA256
62b4fb5acfee3d2deb0d1390df26172cfa2b5a17289541d7e7caa2af7c5d379c

SHA512
5cd96c25eca6189037a78cf9cf4fc93771bd939420c27e9e6fb0144c3c738d3b6c1d69bdfc1bd98c140a40dab0cedee34b37adfed69fc79e5a8c601140376844

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
32b78c2bfc11b538c1b2d6c9b6b0a224

SHA1
89a2c9b25495b433506264425a2af6e6f71a0462

SHA256
016298c841df60191530c4fef92c802b5f414eea93470bdb72f0306c5bd82510

SHA512
ea1a01e7df5e5e3acdffa0ff3f80e4231a7f5f6154058e8e21ca9e04839b96e0c6f347c898738c58bfa609936ddfb0282808438b9e0f52c723f746434dec4108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6ac0fac837e6b58abe8e1a077f58683

SHA1
1436ea81dd3b33a85dd35916678574332e5f1c36

SHA256
13d00073d02728bb0d54f484302846f237e48ee2951f668948236fa981fbdc1a

SHA512
d8fff0e15dd311cbd3faebd76f78a686d1f24af80d74744c70d8bdc07ac674ef39ddf7629dcb60266dc13d43444bd3ee36e0a1287cc245e9e9a2e0ccc7b547ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5e952b5f0e06e7c02243504ee7e0cbbf

SHA1
36344da460de612036ee4e724f8733a8dd2bf117

SHA256
88ae6639a0bf4994cdcb5eb114f9619219cfd92d71e58b9528d5b5f9553e0f22

SHA512
d033b405098b2eddbf09c35fb21ef3767986df92c8def1cf884b50cdb2463feabd952d37502d0fd3790ae6a997b474fa81de3cacc9f3c3a17f963bf601525c23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1b8f1bb567b403bdad96801cbd8b3615

SHA1
5ecc5d1c6d1b5c90f35b69c428fb7b56e1e51e7e

SHA256
232fe1abaef7c7e1476398ac51189575def7476b0b918d7ef10793df475694f1

SHA512
a9eae1758892505e716ac37cd531ca34ba760c6bad46dcbd077f0e3d56b43d7de070d30e57892d4991cb17ddf631e4cef77e9e5ab495e4d2804ee9500d84210c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
12159adc8a32b8fa9c77be37c9e2e52d

SHA1
99f196761d85708a87b65de6f88fe3c6f4e7e8ca

SHA256
c239063188ff08b842b3e64dec72f26686cc7b52a716a8726a498c39117c6af4

SHA512
dfc3460b10da4e036a17892000518c9e4ef76cdcca3c6e7825b116377330f87832d9b6dc932fecb3a0f026bca0eb583d4117bdb1b5536087ad894fd2513a71bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
77733d041698d87435557bace115eac2

SHA1
193861f3de13191724f5f431da3fe14ca9881b35

SHA256
9d3daaf24bd510cdeb24294a391444c72edfdd10c4526929cd360f7d806cdd15

SHA512
875a28ec1bed313789f340dacada2ef05033677d0cdf31d4980bc061587418ee03a46cb2911d1f1016cf247386b4117256e21ee2379b5457de5d78f31a8b653a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d0502072114cb66e3e5b5b3c023ab335

SHA1
949f63c2788688c614b1545ab3754bf31e9cb052

SHA256
5cd2e4579febf45e5e4f41a821371914b1bc275e27956d449f7a390a95509afc

SHA512
04b9f239ee05bd94f6006e5b6ecb0bad35dd66ddc658dfe74312508cac340ec2689cd4913c6ad857297dc2604c18bb5fb9aa8617cdfab586b52cafec6a74d119

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f518e7387950b7cc7129d03e6d8843e1

SHA1
0b12a638263323af541b4b1e3bd2fe7ae0ba0f7c

SHA256
5a1d25f3caf868f61e4a25f5bba07b8f3c913eed56054d487dd64540d30ab78c

SHA512
0297ce2a4aabdf655e8e70636f0d339264d4941528676c7af104c3409a92d2fb8eb4e4055b603308065bce174e46994faeb572696e891bdde67d6728aac79ee5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
615bfa036328c1f9ea6bea2e6cf00cf6

SHA1
bc057569a175ece70ac45c697b21f4b2ed171204

SHA256
62e829634c636d7166725dab5be73a5415c256f38cfa2d4804be9a38f0481d3d

SHA512
ccb923099e6e06aeb8ccb60f4b2cfb63890f9c40e96d5cbc5382b4301bc0c5c0c0ba3c50a1cb8395179a00a9445b0dbd3ec06bcfa2130e8c15a047f790d19e8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eec5.TMP

Filesize
874B

MD5
42981cfb5d567f619c5f7d644282a1c5

SHA1
5b3da5e0262c4d6f38a9d39bf60612a2416ece2e

SHA256
8967a785b54a921b0b63a6d4c489b6995e7b1fbc3d26f9fc83a2086037ffd986

SHA512
f5a89cc0e24002115f9760fbbd580ad19003f01ef318dbd8e2d1a212dbcf80b81b1f29694f32376380a7422e351be9f5ea1046948576568584ea9fd4b2686511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8a5aa4c74ac7bb28c694a73e4efc0054

SHA1
d3ac87ad1ad74377f6f9f3e883861ae3c73783f6

SHA256
d3851bf056a4fd23383955f39b99803359ab5a65f18218164fff74aaf7cd6af9

SHA512
9fbf9abaebfed3d21a9997abe029cdbdd088eac0ae3b32ab2b516fbbece2e4a3ba1d8c27ee2cf5620370fdfa6b154f29d81b5a7d0c54b2124db01edb9fd895d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
68cc527725e3dccd0b0d27ca27f0557b

SHA1
b2047c301bad85098eda8f0a35f349dc30a994d1

SHA256
d5c91311877d0daeefa0951e20de04ecaaf085233790faa7be6df3df3e58018f

SHA512
0c8e86528d9e6cf2c45b09acb67938a8efd2fc4ef56ef5ba7c34151c57b9274d951a4afb16522bf90e0a85ac0016e38d71db2e1add1cf3543db15bc47e7ff1b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0bd05986901ecefbc601e4f54a4182ce

SHA1
9ce9311fe209975ced5200a9acbf41620d6fc282

SHA256
aaf9670b2ddc36cd12dca3cff2c20d54100b380d9ebb9a2497a76e90b03385e6

SHA512
80a36440ad3f33556d604688186a86649375b6cfe3c0485b7b295134265fa23e3e827ba868a0d2b8dc46b648fb14f6798be37ee4e26717acc918caa612a0c9d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
aa37ac8fe39d3eff70f50a5c8bccf1b2

SHA1
db9e3d6c2383a73574326ba36a4ca7ecf998960a

SHA256
dcd5745d509dc99bc81c522128e61f9d4f3907f7c93d1a08fc3bf85562815933

SHA512
a194179b11e391c3969db451de656f82a48913733b010eb1c0692b7cf6d04061f33bfedac5b575dcec1339a268fbcd1ca87685319740ad4ef67363dc62fec9ec

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 288927.crdownload

Filesize
141KB

MD5
de8d08a3018dfe8fd04ed525d30bb612

SHA1
a65d97c20e777d04fb4f3c465b82e8c456edba24

SHA256
2ae0c4a5f1fedf964e2f8a486bf0ee5d1816aac30c889458a9ac113d13b50ceb

SHA512
cc4bbf71024732addda3a30a511ce33ce41cbed2d507dfc7391e8367ddf9a5c4906a57bf8310e3f6535646f6d365835c7e49b95584d1114faf2738dcb1eb451a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 443300.crdownload

Filesize
532KB

MD5
00add4a97311b2b8b6264674335caab6

SHA1
3688de985909cc9f9fa6e0a4f2e43d986fe6d0ec

SHA256
812af0ec9e1dfd8f48b47fd148bafe6eecb42d0a304bc0e4539750dd23820a7f

SHA512
aaf5dae929e6b5809b77b6a79ab833e548b66fb628afeb20b554d678947494a6804cb3d59bf6bbcb2b14cede1a0609aa41f8e7fe8a7999d578e8b7af7144cb70

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 696604.crdownload

Filesize
5KB

MD5
fe537a3346590c04d81d357e3c4be6e8

SHA1
b1285f1d8618292e17e490857d1bdf0a79104837

SHA256
bbc572cced7c94d63a7208f4aba4ed20d1350bef153b099035a86c95c8d96d4a

SHA512
50a5c1ad99ee9f3a540cb30e87ebfdf7561f0a0ee35b3d06c394fa2bad06ca6088a04848ddcb25f449b3c98b89a91d1ba5859f1ed6737119b606968be250c8ce

Download Submit
memory/5232-375-0x0000000001000000-0x0000000001026000-memory.dmp

Filesize
152KB

Download
memory/5232-364-0x0000000001000000-0x0000000001026000-memory.dmp

Filesize
152KB

Download
memory/5944-423-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5944-425-0x0000000000340000-0x00000000003B5000-memory.dmp

Filesize
468KB

Download
memory/5944-427-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/6104-442-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/6104-443-0x0000000000340000-0x00000000003B5000-memory.dmp

Filesize
468KB

Download
memory/6104-445-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download