agenttesla | 34c0039596d87348848d0a28efe6d3fa77155df9cd8571eed952abe9e254f266

Analysis

max time kernel
171s
max time network
295s
platform
windows10_x64
resource
win10-en-20210920
submitted
27-09-2021 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SHIPPING DOCUMENTS_PDF.exe
Size

850KB
MD5

ff8964351ff2ef7ae003d14cd494efb3
SHA1

cff664fffb5c470d4d2ff5dbbdc198276cc77634
SHA256

95e22edcb0a13b44fe04a41017a585c67faf91b47177887b40b1b6190599b4ae
SHA512

2455338bd54e74bdcbcd781158f3888988a77040cf768e4295e25c56800411a76fda65fbf074d8d2edba4cea3e80b9942dee54e9634b98e9d13dad8d26287226

Score

10^/10

agenttesla microsoft evasion keylogger phishing spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.it-tel.eu
Port:
587
Username:
[email protected]
Password:
OZuw)N$0

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3812-134-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3812-135-0x00000000004375EE-mapping.dmp	family_agenttesla
behavioral2/memory/3812-145-0x00000000051C0000-0x00000000056BE000-memory.dmp	family_agenttesla

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Drops file in Drivers directory 1 IoCs

Processes:

SHIPPING DOCUMENTS_PDF.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts SHIPPING DOCUMENTS_PDF.exe
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	SHIPPING DOCUMENTS_PDF.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SHIPPING DOCUMENTS_PDF.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SHIPPING DOCUMENTS_PDF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SHIPPING DOCUMENTS_PDF.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

SHIPPING DOCUMENTS_PDF.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SHIPPING DOCUMENTS_PDF.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	SHIPPING DOCUMENTS_PDF.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft
Suspicious use of SetThreadContext 1 IoCs

Processes:

SHIPPING DOCUMENTS_PDF.exe

description pid process target process

PID 2156 set thread context of 3812 2156 SHIPPING DOCUMENTS_PDF.exe SHIPPING DOCUMENTS_PDF.exe

description	pid	process	target process
PID 2156 set thread context of 3812	2156	SHIPPING DOCUMENTS_PDF.exe	SHIPPING DOCUMENTS_PDF.exe

Drops file in Windows directory 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.msn.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = eda47e9320aed701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{6B35FE00-AC6E-42CB-ABC6-736F9B08D139} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.msn.com\ = "16"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FirstRun	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com\Total = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000f630a976e0630e20a436269e6379b8f19e7e6497f70a6867e591b68d59796f8b054f77657f28dbafdb89b9134ea1b37691a7435299af70641b43abed12859ec631cb7a87d7d56621f1212942f5f99b4b873dbcfff40daeed45c9794c25122ea9ccc3ce185c0cff23391e39ec5b23d8aeb260094fadc4c2c2bc4423068fc0354f16594636816b3b1840a0902f03be08b8ba3082ec9574eff96dd5ba83d02f497c9fab1c8ba79340ff73c759e59d69ecbdf1cddf5b38bd7a757f9a0ad79bffb8ce11db3cd47c259af7e7b2caca35c606c78b577a9e233fb1ebb9b403a736d131f09f07862efbbf124dda838cb2be73940d93ee92ad4d9a387edc43506d2f43c5e536513c3a21031b166059ef7ad7121a90aab2cbc30f6e23dd0b68910020f6ff6990d79d07e08fc1644f54fd22284210b68fc30a716e5b06000d41f5741c8a5d5479bbbddbcc042a008393339392a24c018941e4885101a76dc6ef5942d49f3218e81bd3bc160366b9f53844afe0d481ce974cf3d588ffde0e8e9284c7bdd5ba4c2519b3d4b42a3d44e362b2ba3e774a2df804bea5c5f72c9736399d5dd2fe7436ba9641f34e3e6ece	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\msn.com\Total = "23"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedHeight = "600"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = eda47e9320aed701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\msn.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdom = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "800"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 24ce2b10ceb3d701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a4bd1116ceb3d701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.microsoft.com\ = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "9"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com\Total = "172"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0"	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exeSHIPPING DOCUMENTS_PDF.exe

pid process

4948 powershell.exe
3812 SHIPPING DOCUMENTS_PDF.exe
3812 SHIPPING DOCUMENTS_PDF.exe
4948 powershell.exe
4948 powershell.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

1348 MicrosoftEdgeCP.exe
1348 MicrosoftEdgeCP.exe
1348 MicrosoftEdgeCP.exe
1348 MicrosoftEdgeCP.exe

pid	process
4948	powershell.exe
3812	SHIPPING DOCUMENTS_PDF.exe
3812	SHIPPING DOCUMENTS_PDF.exe
4948	powershell.exe
4948	powershell.exe

pid	process
1348	MicrosoftEdgeCP.exe
1348	MicrosoftEdgeCP.exe
1348	MicrosoftEdgeCP.exe
1348	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exepowershell.exeSHIPPING DOCUMENTS_PDF.exe

description	pid	process
Token: SeDebugPrivilege	592	MicrosoftEdge.exe
Token: SeDebugPrivilege	592	MicrosoftEdge.exe
Token: SeDebugPrivilege	592	MicrosoftEdge.exe
Token: SeDebugPrivilege	592	MicrosoftEdge.exe
Token: SeDebugPrivilege	2088	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2088	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2088	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2088	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	364	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	364	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	364	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	364	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4512	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4512	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	592	MicrosoftEdge.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	3812	SHIPPING DOCUMENTS_PDF.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid process

592 MicrosoftEdge.exe
1348 MicrosoftEdgeCP.exe
1348 MicrosoftEdgeCP.exe
364 MicrosoftEdgeCP.exe

pid	process
592	MicrosoftEdge.exe
1348	MicrosoftEdgeCP.exe
1348	MicrosoftEdgeCP.exe
364	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

MicrosoftEdgeCP.exeSHIPPING DOCUMENTS_PDF.exe

description	pid	process	target process
PID 1348 wrote to memory of 364	1348	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1348 wrote to memory of 364	1348	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1348 wrote to memory of 364	1348	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1348 wrote to memory of 364	1348	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1348 wrote to memory of 364	1348	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1348 wrote to memory of 2088	1348	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1348 wrote to memory of 2088	1348	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1348 wrote to memory of 2088	1348	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1348 wrote to memory of 2088	1348	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1348 wrote to memory of 2088	1348	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1348 wrote to memory of 2088	1348	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1348 wrote to memory of 2088	1348	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1348 wrote to memory of 2088	1348	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1348 wrote to memory of 2088	1348	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2156 wrote to memory of 4948	2156	SHIPPING DOCUMENTS_PDF.exe	powershell.exe
PID 2156 wrote to memory of 4948	2156	SHIPPING DOCUMENTS_PDF.exe	powershell.exe
PID 2156 wrote to memory of 4948	2156	SHIPPING DOCUMENTS_PDF.exe	powershell.exe
PID 2156 wrote to memory of 3812	2156	SHIPPING DOCUMENTS_PDF.exe	SHIPPING DOCUMENTS_PDF.exe
PID 2156 wrote to memory of 3812	2156	SHIPPING DOCUMENTS_PDF.exe	SHIPPING DOCUMENTS_PDF.exe
PID 2156 wrote to memory of 3812	2156	SHIPPING DOCUMENTS_PDF.exe	SHIPPING DOCUMENTS_PDF.exe
PID 2156 wrote to memory of 3812	2156	SHIPPING DOCUMENTS_PDF.exe	SHIPPING DOCUMENTS_PDF.exe
PID 2156 wrote to memory of 3812	2156	SHIPPING DOCUMENTS_PDF.exe	SHIPPING DOCUMENTS_PDF.exe
PID 2156 wrote to memory of 3812	2156	SHIPPING DOCUMENTS_PDF.exe	SHIPPING DOCUMENTS_PDF.exe
PID 2156 wrote to memory of 3812	2156	SHIPPING DOCUMENTS_PDF.exe	SHIPPING DOCUMENTS_PDF.exe
PID 2156 wrote to memory of 3812	2156	SHIPPING DOCUMENTS_PDF.exe	SHIPPING DOCUMENTS_PDF.exe

C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENTS_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENTS_PDF.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENTS_PDF.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4948
- C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENTS_PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENTS_PDF.exe"
  2⤵
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3812

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:592

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1676

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2088

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:364

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Windows\System32\iexpress.exe
"C:\Windows\System32\iexpress.exe"
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SHIPPING DOCUMENTS_PDF.exe.log

MD5
702accedbb5f4330e71e04b0adcebcab

SHA1
8758b0e8bb8fb8036fd30134015c4eb3f6113b5b

SHA256
eac8901972a0bc1e30fe8451564817c5ea116870f8483c128650a0783e48c57f

SHA512
19d4fcd7a58b65282638a7bb633fbcbe4ddb24edba81d43d333fcbbbb38b114ce64bf7a5d45516249ceca343a2d854aa3e531af2960d03d468f6264e00a34f45

Download Submit
memory/2156-126-0x00000000086E0000-0x0000000008748000-memory.dmp

Filesize
416KB

Download
memory/2156-125-0x0000000008990000-0x0000000008991000-memory.dmp

Filesize
4KB

Download
memory/2156-119-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/2156-120-0x0000000008510000-0x0000000008511000-memory.dmp

Filesize
4KB

Download
memory/2156-127-0x0000000008750000-0x000000000878C000-memory.dmp

Filesize
240KB

Download
memory/2156-122-0x00000000051A0000-0x000000000569E000-memory.dmp

Filesize
5.0MB

Download
memory/2156-118-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download
memory/2156-115-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/2156-121-0x0000000005350000-0x0000000005357000-memory.dmp

Filesize
28KB

Download
memory/2156-117-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/2156-129-0x00000000088A0000-0x00000000088A1000-memory.dmp

Filesize
4KB

Download
memory/3812-382-0x0000000005620000-0x0000000005621000-memory.dmp

Filesize
4KB

Download
memory/3812-145-0x00000000051C0000-0x00000000056BE000-memory.dmp

Filesize
5.0MB

Download
memory/3812-134-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3812-135-0x00000000004375EE-mapping.dmp

Download
memory/3812-391-0x00000000051C0000-0x00000000056BE000-memory.dmp

Filesize
5.0MB

Download
memory/4948-141-0x00000000071C0000-0x00000000071C1000-memory.dmp

Filesize
4KB

Download
memory/4948-158-0x0000000009460000-0x0000000009493000-memory.dmp

Filesize
204KB

Download
memory/4948-143-0x00000000076B0000-0x00000000076B1000-memory.dmp

Filesize
4KB

Download
memory/4948-142-0x00000000071C2000-0x00000000071C3000-memory.dmp

Filesize
4KB

Download
memory/4948-133-0x0000000007800000-0x0000000007801000-memory.dmp

Filesize
4KB

Download
memory/4948-147-0x0000000008040000-0x0000000008041000-memory.dmp

Filesize
4KB

Download
memory/4948-148-0x0000000007E50000-0x0000000007E51000-memory.dmp

Filesize
4KB

Download
memory/4948-149-0x00000000087F0000-0x00000000087F1000-memory.dmp

Filesize
4KB

Download
memory/4948-150-0x00000000086A0000-0x00000000086A1000-memory.dmp

Filesize
4KB

Download
memory/4948-139-0x0000000007610000-0x0000000007611000-memory.dmp

Filesize
4KB

Download
memory/4948-165-0x0000000009440000-0x0000000009441000-memory.dmp

Filesize
4KB

Download
memory/4948-170-0x00000000097F0000-0x00000000097F1000-memory.dmp

Filesize
4KB

Download
memory/4948-171-0x0000000009990000-0x0000000009991000-memory.dmp

Filesize
4KB

Download
memory/4948-240-0x000000007E130000-0x000000007E131000-memory.dmp

Filesize
4KB

Download
memory/4948-241-0x00000000071C3000-0x00000000071C4000-memory.dmp

Filesize
4KB

Download
memory/4948-366-0x0000000009920000-0x0000000009921000-memory.dmp

Filesize
4KB

Download
memory/4948-372-0x0000000009910000-0x0000000009911000-memory.dmp

Filesize
4KB

Download
memory/4948-132-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download
memory/4948-128-0x0000000000000000-mapping.dmp

Download