njrat | f992aa328b81c89418d075b8a53e79b4eae71f9a97d50577c25a67c9c430031c

General

Target

f992aa328b81c89418d075b8a53e79b4eae71f9a97d50577c25a67c9c430031c.exe
Size

374KB
MD5

1de15800d08f248b647077f0fe52f5c1
SHA1

40616e40110b24faf0ff3af1285e628f3f8e595d
SHA256

f992aa328b81c89418d075b8a53e79b4eae71f9a97d50577c25a67c9c430031c
SHA512

012995a859d376965363f49ef1cdaab5d88a9a57847786f2421183757942edf135f933f0a66ab0e2ce281c8287e3efa87c11f90118f0d745166614446132cc50

Score

10^/10

njrat lime link pdf persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

Lime

C2

soportesltda30.duckdns.org:4433

Mutex

Client.exe

Attributes

reg_key
Client.exe
splitter
jairpicc

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

windows.exe

pid process

424 windows.exe
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

pid	process
424	windows.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f992aa328b81c89418d075b8a53e79b4eae71f9a97d50577c25a67c9c430031c.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	f992aa328b81c89418d075b8a53e79b4eae71f9a97d50577c25a67c9c430031c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 1 IoCs

Processes:

WScript.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.EXE WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.EXE	WScript.exe

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\leer.pdf	pdf_with_link_action

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

WaaSMedicAgent.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe

Modifies registry class 2 IoCs

Processes:

f992aa328b81c89418d075b8a53e79b4eae71f9a97d50577c25a67c9c430031c.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	f992aa328b81c89418d075b8a53e79b4eae71f9a97d50577c25a67c9c430031c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msedge.exemsedge.exe

pid process

4344 msedge.exe
4344 msedge.exe
3576 msedge.exe
3576 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

msedge.exe

pid process

3576 msedge.exe
3576 msedge.exe
3576 msedge.exe
3576 msedge.exe
3576 msedge.exe

pid	process
4344	msedge.exe
4344	msedge.exe
3576	msedge.exe
3576	msedge.exe

pid	process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	4628	svchost.exe
Token: SeCreatePagefilePrivilege	4628	svchost.exe
Token: SeShutdownPrivilege	4628	svchost.exe
Token: SeCreatePagefilePrivilege	4628	svchost.exe
Token: SeShutdownPrivilege	4628	svchost.exe
Token: SeCreatePagefilePrivilege	4628	svchost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msedge.exe

pid process

3576 msedge.exe
3576 msedge.exe

pid	process
3576	msedge.exe
3576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f992aa328b81c89418d075b8a53e79b4eae71f9a97d50577c25a67c9c430031c.exemsedge.exeWScript.exewindows.exefondue.exe

description	pid	process	target process
PID 4400 wrote to memory of 3576	4400	f992aa328b81c89418d075b8a53e79b4eae71f9a97d50577c25a67c9c430031c.exe	msedge.exe
PID 4400 wrote to memory of 3576	4400	f992aa328b81c89418d075b8a53e79b4eae71f9a97d50577c25a67c9c430031c.exe	msedge.exe
PID 3576 wrote to memory of 3068	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3068	3576	msedge.exe	msedge.exe
PID 4400 wrote to memory of 3152	4400	f992aa328b81c89418d075b8a53e79b4eae71f9a97d50577c25a67c9c430031c.exe	WScript.exe
PID 4400 wrote to memory of 3152	4400	f992aa328b81c89418d075b8a53e79b4eae71f9a97d50577c25a67c9c430031c.exe	WScript.exe
PID 4400 wrote to memory of 3152	4400	f992aa328b81c89418d075b8a53e79b4eae71f9a97d50577c25a67c9c430031c.exe	WScript.exe
PID 3152 wrote to memory of 424	3152	WScript.exe	windows.exe
PID 3152 wrote to memory of 424	3152	WScript.exe	windows.exe
PID 3152 wrote to memory of 424	3152	WScript.exe	windows.exe
PID 424 wrote to memory of 2348	424	windows.exe	fondue.exe
PID 424 wrote to memory of 2348	424	windows.exe	fondue.exe
PID 424 wrote to memory of 2348	424	windows.exe	fondue.exe
PID 2348 wrote to memory of 1664	2348	fondue.exe	FonDUE.EXE
PID 2348 wrote to memory of 1664	2348	fondue.exe	FonDUE.EXE
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 788	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4344	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4344	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4860	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4860	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4860	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4860	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4860	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4860	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4860	3576	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\f992aa328b81c89418d075b8a53e79b4eae71f9a97d50577c25a67c9c430031c.exe
"C:\Users\Admin\AppData\Local\Temp\f992aa328b81c89418d075b8a53e79b4eae71f9a97d50577c25a67c9c430031c.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\leer.pdf
2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0xfc,0x100,0x40,0x104,0x7ffe839146f8,0x7ffe83914708,0x7ffe83914718
3⤵
PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,10256157769233921397,9595159963088267493,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
3⤵
PID:788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,10256157769233921397,9595159963088267493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,10256157769233921397,9595159963088267493,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:8
3⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10256157769233921397,9595159963088267493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
3⤵
PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10256157769233921397,9595159963088267493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1
3⤵
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,10256157769233921397,9595159963088267493,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4500 /prefetch:8
3⤵
PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10256157769233921397,9595159963088267493,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
3⤵
PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10256157769233921397,9595159963088267493,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
3⤵
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10256157769233921397,9595159963088267493,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
3⤵
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2136,10256157769233921397,9595159963088267493,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=2716 /prefetch:6
3⤵
PID:744

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\win.vbs"
2⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3152

C:\Users\Admin\AppData\Local\Temp\windows.exe
"C:\Users\Admin\AppData\Local\Temp\windows.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
4⤵
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
5⤵
PID:1664

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe a00732b09400a68c8a4ddca59ea25e51 jW5FwuBBW0STXcRNHPSlVw.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:4336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\leer.pdf
MD5
1db6b198366804e52fa1fbc3599934bf

SHA1
171b5758a6483ce5ccddfc3d5dc5e9d40c7aa7b1

SHA256
60205229cab8dce06632c2b9d61b0628186e74ff6fc7db66112d149a576ec8dc

SHA512
35631ecaf2124ee272f78e6382dc4b8f939ff8fe4b11f874176e44d20526b524b3540d5bf7fd2e21c81e92a69f7f31257e5f1ea1cf9f7e79ba01fd2a7f77efed

Download Submit
C:\Users\Admin\AppData\Local\Temp\win.vbs
MD5
466373d5f9d9e8daa9052c303071080f

SHA1
410d62f9075cae08e6b31c5e666f67892982a6ba

SHA256
f4056dbe3779c8e0700567ed46b782ddc7bfda547e7e63b43d2748ef60e12c12

SHA512
de1eca6b8f17980d44ed5c4de455a78865bc117cf51b02e9e1f026096d417e6593272aa64f45fb8f2657b646608b84df25842b2a5b9b45cda4b2e55bc3e0a303

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows.exe
MD5
e755d66ec3fb3877c81b6c6818ef083e

SHA1
e79fdfd8ac6794ebf4daeb044dc98ea47ddb3c4f

SHA256
56203d61bb74a63227367a5d68f3a4869c109be343fccd0bf992f30d0d3192ad

SHA512
f1323391fb5bb2ad278a21905508de06e1ce5dd92895de30f010b9858e74069ec8ce97b7ef4e20cf5e17f6e7a37dd54da5791f2c3e0b5a48cd30318144c4714e

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows.exe
MD5
e755d66ec3fb3877c81b6c6818ef083e

SHA1
e79fdfd8ac6794ebf4daeb044dc98ea47ddb3c4f

SHA256
56203d61bb74a63227367a5d68f3a4869c109be343fccd0bf992f30d0d3192ad

SHA512
f1323391fb5bb2ad278a21905508de06e1ce5dd92895de30f010b9858e74069ec8ce97b7ef4e20cf5e17f6e7a37dd54da5791f2c3e0b5a48cd30318144c4714e

Download Submit
\??\pipe\LOCAL\crashpad_3576_FOOCLPWNLURTMBZW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/788-289-0x00007FFEA06B0000-0x00007FFEA06B1000-memory.dmp

Filesize
4KB

Download
memory/4628-342-0x000002709C0E0000-0x000002709C0F0000-memory.dmp

Filesize
64KB

Download
memory/4628-346-0x000002709E5B0000-0x000002709E5B4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads