Analysis
- geolocation tags
- user interaction
yes - max time kernel
898s - max time network
881s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
28/08/2026, 21:37
General
- Target http://frankeldevco.com
- Sample260828-1grq1stdqa
Score
9/10
Malware Config
Signatures
- .NET loader stage by imphash + section/import shape 6 IoCs
- CLR-hosted .NET infostealer assembly: GDI screen capture + AES CryptoStream + raw TcpClient exfil + 7 IoCs
- CLR-hosted .NET infostealer: reflective assembly + browser cred theft + AES socket exfil 6 IoCs
- CLR-hosting MZER loader (student_s.bin, /std/ branch); boots .NET/Donut infostealer via mscoree. 6 IoCs
- CLR-hosting MZER loader stage (my_sss.bin / student_s.bin), ~276KB 6 IoCs
- ClickFix v8 — MZER custom loader stub with x64 PIC bootstrapper 8 IoCs
- Complete MZER GetPC stub as a code-anchor (immediate wildcarded) 8 IoCs
- Donut .NET loader by imphash — stable across all waves/branches despite per-lure SHA-256 churn 6 IoCs
- Durable RSA-1024 CAPI C2 handshake public key (modulus). Cross-wave anchor. 1 IoCs
- Durable cross-wave MZER+GetPC polyglot prologue at offset 0 (loader stage) 8 IoCs
- Durable native downloader / CLR loader imphash anchors (PE stages of the family) 8 IoCs
- Embedded CAPI PUBLICKEYBLOB carrying the DURABLE RSA-1024 C2 handshake key (e=65537). Client RSA-wra 1 IoCs
- Embedded RSA-1024 C2 handshake public key (CAPI RSA1 blob, e=65537). Client RSA-wraps the AES sessio 1 IoCs
- Fires on any WP-002 chain component 9 IoCs
- Fires on any WP-002 chain component (prologue OR durable imphash OR embedded C2 key). 9 IoCs
- Injected CLR-hosted .NET infostealer (memory scan): AES-over-raw-TCP + screen capture + WMI recon 7 IoCs
- MZER CLR-hosting loader; boots .NET/Donut infostealer via mscoree. Durable imphash. 6 IoCs
- MZER polyglot header + complete GetPC self-locating x64 stub (branch immediate wildcarded) 8 IoCs
- MZER polyglot header: MZ-lookalike that is also a GetPC self-locating x64 stub at offset 0. Loader-s 8 IoCs
- MZER polyglot header: position-independent Donut shellcode masquerading as PE (cross-version cluster 8 IoCs
- MZER polyglot: MZ-lookalike header that is also a GetPC self-locating x64 stub 8 IoCs
- MZER polyglot: MZ-lookalike header that is also a GetPC self-locating x64 stub (offset 0). Durable c 8 IoCs
- MZER polyglot: MZ-lookalike header that is also a GetPC self-locating x64 stub. Durable cross-wave c 8 IoCs
- MZER-polyglot Donut loader family: header + GetPC bootstrap prologue at offset 0 8 IoCs
- Memory-scan capability fingerprint for the WP-002 CLR-hosted infostealer, confirmed by direct memory 6 IoCs
- NEW in V12.1: native MinGW-w64/GCC-15 WinHTTP downloader stage fetching enterprise/student_s.bin 2 IoCs
- Native PE32+ loader: process-enum + remote-thread injection + WinHTTP stage fetch 2 IoCs
- Native x64 MZER WinHTTP downloader/injector (~50KB). Served as /enterprise/my_sss.bin. 2 IoCs
- Network IOCs for the WP-002 stage host and C2 gate 9 IoCs
- V12.1 infra: new stage-2 IP, recycled V11 C2 domain, TDS, lure host, EtherHiding contract 2 IoCs
- WinHTTP downloader by imphash — durable cross-wave-cluster pivot 2 IoCs
- WinHTTP downloader/injector MZER stage (std_enterprise ~50KB). 2 IoCs
- WinHTTP downloader/injector MZER stage, ~50KB 2 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 8 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 33 IoCs
- Suspicious use of SendNotifyMessage 16 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://frankeldevco.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2e0,0x7ffd3775c188,0x7ffd3775c194,0x7ffd3775c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,11112904935977087148,760254110955927763,524288 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,817209197288503548,10140785055058562891,262144 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,383274405376964821,11057529486864953663,524288 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,3243313314569455692,2712731736844322125,2097152 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,10272951348773107074,10199875705172990153,2097152 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,2102717938797689593,13317395546426856627,2097152 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,13099842656414395409,4134044802550813803,2097152 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,13667178707735381177,7521411003454613935,524288 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,14848057858019398775,11925549330397781712,524288 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,9600191726883850297,5920518279745063669,524288 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,9600191726883850297,5920518279745063669,524288 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6592,i,13894327518706487847,4763520800097391022,2097152 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3660,i,18213207962577775548,18347877946443162760,2097152 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,8343654872312312861,17035392113761374565,524288 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,18308678753761834197,13238118334681001410,524288 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,17654027731921528976,16818046269261946301,524288 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,18263782371569848598,12467668309000147157,524288 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6624,i,17841024379918813027,11166906064896456272,2097152 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3808,i,1527888430198937309,13985922305115069348,2097152 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4860,i,16193857176105778961,1866008702167147764,262144 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6640,i,15064398503192709575,6462906408568661702,2097152 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5412,i,1417224727465910007,8468859748072668091,2097152 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,14580373436202899076,10495276629525587606,524288 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,5668036989743904195,3704331036936311380,524288 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,16248689287100211194,2566734298720786464,524288 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1088,i,14053351901930757814,9513522596485167889,524288 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,9784111718182866697,4596284205455700475,524288 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6940,i,4603156780459530587,13210700420825043253,2097152 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,5025937986498216480,5449311435286207116,524288 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7540,i,7716404858919769017,2269607945001648425,2097152 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7716,i,15272113228533156748,7955193752769652957,2097152 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4368,i,9165572068585452435,16903684051342689152,2097152 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5616,i,462867034629020559,5361627758023627270,2097152 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,10800678900283734371,1639087774867139221,524288 --field-trial-handle=2232,i,17983200693382868433,14722905954117142874,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\acffbxbu\acffbxbu.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10CA.tmp" "c:\Users\Admin\AppData\Local\Temp\acffbxbu\CSCF37A7BAA7ED84DF39BBB2A38D56B3E9E.TMP"3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
LOG.old
LOG.old
f_000077
f_000078
f_000079
f_00007a
f_00007b
f_00007c
f_000081
f_000082
f_000083
f_00008e
f_00008f
f_0000ab
f_0000ad
f_0000b2
f_0000b8
f_0000bb
f_0000d4
f_00011b
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe59aa6f.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5da20f.TMP
index.txt
index.txt
the-real-index
the-real-index
CURRENT
MANIFEST-000001
13d5bd85-102e-4a8c-ad68-0bdcaedf6057.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5af667.TMP
52b46c90-371b-4c93-aeb9-7d62b240b5d0.tmp
RES10CA.tmp
acffbxbu.dll
CSCF37A7BAA7ED84DF39BBB2A38D56B3E9E.TMP
acffbxbu.0.cs
acffbxbu.cmdline
memory/3148-347-0x0000000000DA0000-0x0000000000DB9000-memory.dmp
memory/3148-343-0x000001F3CEB10000-0x000001F3CEB5D000-memory.dmp
memory/3148-340-0x000001F3CEB10000-0x000001F3CEB5D000-memory.dmp
memory/3148-344-0x000001F3CEB10000-0x000001F3CEB5D000-memory.dmp
memory/3148-493-0x000001F3CEB10000-0x000001F3CEB5D000-memory.dmp
memory/3148-342-0x000001F3CEB10000-0x000001F3CEB5D000-memory.dmp
memory/3148-341-0x000001F3CEB10000-0x000001F3CEB5D000-memory.dmp
memory/3148-346-0x000001F3E7260000-0x000001F3E7290000-memory.dmp
memory/5684-339-0x000001E16C350000-0x000001E16C35D000-memory.dmp
memory/5684-364-0x000001E16C350000-0x000001E16C35D000-memory.dmp
memory/5684-338-0x000001E16C1F0000-0x000001E16C1F8000-memory.dmp
memory/5684-312-0x000001E16C200000-0x000001E16C248000-memory.dmp
memory/5684-311-0x000001E16BE10000-0x000001E16BE32000-memory.dmp