redline | 60c63fafcbcb2655d7806d9715f1755db205a975ddf68421967a39a2abcfb11a

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
11-04-2022 02:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.exe
Size

4.5MB
MD5

f556df38b1abf7c5ef71b6bc040bfe93
SHA1

64a174173f3e4c46b8db36fa04f076dca5a3aac7
SHA256

60c63fafcbcb2655d7806d9715f1755db205a975ddf68421967a39a2abcfb11a
SHA512

0a74598fb4b4b256555c0e4b8e7b654cc0fcb6a18c16f9da912eeea4b24d79f66776e3484200277ff9705032ef60afca97639df4a273cedb2729d6dd085b598b

Score

10^/10

redline infostealer persistence spyware

Malware Config

Extracted

Family

redline

104.244.76.137:4487

Attributes

auth_value
67c42657a2dc51f3323efd90a04a2b03

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3920-153-0x0000000000630000-0x0000000000650000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
2172	s.exe
4724	setup.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\International\Geo\Nation	1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\International\Geo\Nation	setup.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lol.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lol.bat	cmd.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4724 set thread context of 3464	4724	setup.exe	89
PID 2172 set thread context of 3920	2172	s.exe	96

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\56508ab0-9ac5-4a80-bb37-611202f2f4d1.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220411045612.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4492	3464	WerFault.exe	89
4236	4724	WerFault.exe	84

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3732	schtasks.exe
4404	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4724	setup.exe
4724	setup.exe
4724	setup.exe
4724	setup.exe
4724	setup.exe
4724	setup.exe
4724	setup.exe
4724	setup.exe
4724	setup.exe
4724	setup.exe
4724	setup.exe
4928	powershell.exe
4928	powershell.exe
1164	msedge.exe
1164	msedge.exe
3596	msedge.exe
3596	msedge.exe
3920	AppLaunch.exe
3920	AppLaunch.exe
3156	identity_helper.exe
3156	identity_helper.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	setup.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	3920	AppLaunch.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2172	1532	1.exe	81
PID 1532 wrote to memory of 2172	1532	1.exe	81
PID 1532 wrote to memory of 2172	1532	1.exe	81
PID 1532 wrote to memory of 4724	1532	1.exe	84
PID 1532 wrote to memory of 4724	1532	1.exe	84
PID 1532 wrote to memory of 2852	1532	1.exe	85
PID 1532 wrote to memory of 2852	1532	1.exe	85
PID 1532 wrote to memory of 2852	1532	1.exe	85
PID 1532 wrote to memory of 312	1532	1.exe	87
PID 1532 wrote to memory of 312	1532	1.exe	87
PID 1532 wrote to memory of 312	1532	1.exe	87
PID 4724 wrote to memory of 3464	4724	setup.exe	89
PID 4724 wrote to memory of 3464	4724	setup.exe	89
PID 4724 wrote to memory of 3464	4724	setup.exe	89
PID 4724 wrote to memory of 3464	4724	setup.exe	89
PID 4724 wrote to memory of 3464	4724	setup.exe	89
PID 4724 wrote to memory of 3464	4724	setup.exe	89
PID 4724 wrote to memory of 3464	4724	setup.exe	89
PID 4724 wrote to memory of 3464	4724	setup.exe	89
PID 4724 wrote to memory of 3464	4724	setup.exe	89
PID 4724 wrote to memory of 3464	4724	setup.exe	89
PID 4724 wrote to memory of 1756	4724	setup.exe	93
PID 4724 wrote to memory of 1756	4724	setup.exe	93
PID 4724 wrote to memory of 3732	4724	setup.exe	94
PID 4724 wrote to memory of 3732	4724	setup.exe	94
PID 2172 wrote to memory of 3920	2172	s.exe	96
PID 2172 wrote to memory of 3920	2172	s.exe	96
PID 2172 wrote to memory of 3920	2172	s.exe	96
PID 2172 wrote to memory of 3920	2172	s.exe	96
PID 4724 wrote to memory of 4404	4724	setup.exe	97
PID 4724 wrote to memory of 4404	4724	setup.exe	97
PID 2172 wrote to memory of 3920	2172	s.exe	96
PID 4724 wrote to memory of 4928	4724	setup.exe	99
PID 4724 wrote to memory of 4928	4724	setup.exe	99
PID 312 wrote to memory of 3596	312	cmd.exe	104
PID 312 wrote to memory of 3596	312	cmd.exe	104
PID 3596 wrote to memory of 1448	3596	msedge.exe	105
PID 3596 wrote to memory of 1448	3596	msedge.exe	105
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108
PID 3596 wrote to memory of 4416	3596	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\Temp\s.exe
  "C:\Windows\Temp\s.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3920
- C:\Windows\Temp\setup.exe
  "C:\Windows\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 572
      4⤵
      Program crash
      PID:4492
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /delete /tn WindowsService /f
    3⤵
    PID:1756
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn WindowsService /tr "C:\Users\Admin\AppData\Roaming\Windows Folder\Windows Service.exe" /sc onlogon /rl highest
    3⤵
    - Creates scheduled task(s)
    PID:3732
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn WindowsServiceUpload /tr "C:\Users\Admin\AppData\Roaming\Windows Folder\Windows Service.exe" /f /rl highest
    3⤵
    - Creates scheduled task(s)
    PID:4404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Folder'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 4724 -s 1764
    3⤵
    - Program crash
    PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\Temp\run.bat" "
  2⤵
  - Drops startup file
  PID:2852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\Temp\lol.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://methodmedia.biz/?p=gmzgcobuge5gi3bpgu4dkmbz
    3⤵
    - Adds Run key to start application
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x40,0x104,0x7fff823446f8,0x7fff82344708,0x7fff82344718
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3165633036019257130,9120918416067446972,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3165633036019257130,9120918416067446972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3165633036019257130,9120918416067446972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3165633036019257130,9120918416067446972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3165633036019257130,9120918416067446972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
      4⤵
      PID:2188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,3165633036019257130,9120918416067446972,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4852 /prefetch:8
      4⤵
      PID:2748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,3165633036019257130,9120918416067446972,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5728 /prefetch:8
      4⤵
      PID:3720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3165633036019257130,9120918416067446972,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
      4⤵
      PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3165633036019257130,9120918416067446972,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3165633036019257130,9120918416067446972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
      4⤵
      PID:4024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:4436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6d4c15460,0x7ff6d4c15470,0x7ff6d4c15480
        5⤵
        
        PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3165633036019257130,9120918416067446972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,3165633036019257130,9120918416067446972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5060 /prefetch:8
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,3165633036019257130,9120918416067446972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6844 /prefetch:8
      4⤵
      PID:3896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,3165633036019257130,9120918416067446972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5020 /prefetch:8
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3165633036019257130,9120918416067446972,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3052 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,3165633036019257130,9120918416067446972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3296 /prefetch:8
      4⤵
      PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3464 -ip 3464
1⤵
PID:1736

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 4724 -ip 4724
1⤵
PID:3392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
a1616ba7384c405c7d76c0ac7f8cc1a9

SHA1
dfd8fd96255e91c93207caa7658903b3fbf88816

SHA256
35d04e1b2550624bc9499e8dbdea60e9a317d9d14fbf5d28f386e98d12a277b6

SHA512
9c47766848361b0ffc1d88c33be9ad8275a16146b1b2a00b6f93fed4d8a6e1df34b5f62086e4d6c3b1b04d812ed517c597b2218353210a524cdbc5ac20bcf895

Download Submit
C:\Windows\Temp\lol.bat

Filesize
62B

MD5
f95588de9545bb2369f424377a4c0289

SHA1
9e8e0876df2171cbca169e90965442f106cb0600

SHA256
70915616ff58efa0206685c04e9c3a1a02fc0a0e8a5396509552b1903d9c8097

SHA512
56d82f43863d181af70ce5b943ed9f23b1a18523cfc322cebce17a7f823ebf97420a2d38478fd4839bbcb1f9f659ad9bde965f7891e192b17dc4610e02b5b6f4

Download Submit
C:\Windows\Temp\run.bat

Filesize
98B

MD5
731afe244b2414169a5f630d52646e56

SHA1
e3771ccdccd8c306ee5fc4f264cfc3310690458c

SHA256
6c24e5b6a9aaced68f9f93581913bdea4cc1077060827d5d59d6680859e4e552

SHA512
84e0dc44ae3eadf6d31484119294126f5a056add94733fea2ba5597b6a302fc107117f5c5029d4ce0ff8e5c859c4de9c456aa5f01d420f25a3d56dc569801ff1

Download Submit
C:\Windows\Temp\s.exe

Filesize
3.9MB

MD5
89864c831ebb2a57b104544ef4ad5bc5

SHA1
7b863625c47af7ae464223f531540e0a85a045f2

SHA256
bbae1e89d39bff79d315a5be1b7934223691883c16c3f7ad8cc2ea98b30824bb

SHA512
72e44af099372eac1134938f38bc9e19a026d603191e5d81c0a44a066f652a3e2cc71f5a75c1b16e4cc2f83d379cf5a7e293e7f47d6a8364b00e48e8fef028e2

Download Submit
C:\Windows\Temp\s.exe

Filesize
3.9MB

MD5
89864c831ebb2a57b104544ef4ad5bc5

SHA1
7b863625c47af7ae464223f531540e0a85a045f2

SHA256
bbae1e89d39bff79d315a5be1b7934223691883c16c3f7ad8cc2ea98b30824bb

SHA512
72e44af099372eac1134938f38bc9e19a026d603191e5d81c0a44a066f652a3e2cc71f5a75c1b16e4cc2f83d379cf5a7e293e7f47d6a8364b00e48e8fef028e2

Download Submit
C:\Windows\Temp\setup.exe

Filesize
968KB

MD5
92c419119e1a95da7d3ce5c85724872f

SHA1
494650fe4fdca8260cf48a006979d14c6a890c8b

SHA256
5fb5101940f2fa6e9145b664ef88b3cb3258cf8743dd1f13f76dd7bbdb652b96

SHA512
3d6699910ba9f466e940db1abf89ca7e88466f4f5ce3cd11ad7b2da3ad0fb1045e11f831d4766347a2b6b7959b7c00b0f93d8e7f4bf9b27e00bc17319f3da5b9

Download Submit
C:\Windows\Temp\setup.exe

Filesize
968KB

MD5
92c419119e1a95da7d3ce5c85724872f

SHA1
494650fe4fdca8260cf48a006979d14c6a890c8b

SHA256
5fb5101940f2fa6e9145b664ef88b3cb3258cf8743dd1f13f76dd7bbdb652b96

SHA512
3d6699910ba9f466e940db1abf89ca7e88466f4f5ce3cd11ad7b2da3ad0fb1045e11f831d4766347a2b6b7959b7c00b0f93d8e7f4bf9b27e00bc17319f3da5b9

Download Submit
memory/2172-139-0x0000000000400000-0x0000000000AE0000-memory.dmp

Filesize
6.9MB

Download
memory/3464-141-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3464-137-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3464-140-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3920-201-0x0000000004EB0000-0x0000000004F42000-memory.dmp

Filesize
584KB

Download
memory/3920-173-0x0000000004B80000-0x0000000004BBC000-memory.dmp

Filesize
240KB

Download
memory/3920-172-0x0000000004C10000-0x0000000004D1A000-memory.dmp

Filesize
1.0MB

Download
memory/3920-207-0x00000000079E0000-0x0000000007F0C000-memory.dmp

Filesize
5.2MB

Download
memory/3920-168-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

Filesize
72KB

Download
memory/3920-165-0x0000000005040000-0x0000000005658000-memory.dmp

Filesize
6.1MB

Download
memory/3920-200-0x0000000005C10000-0x00000000061B4000-memory.dmp

Filesize
5.6MB

Download
memory/3920-206-0x00000000072E0000-0x00000000074A2000-memory.dmp

Filesize
1.8MB

Download
memory/3920-205-0x00000000062B0000-0x0000000006300000-memory.dmp

Filesize
320KB

Download
memory/3920-204-0x00000000061C0000-0x00000000061DE000-memory.dmp

Filesize
120KB

Download
memory/3920-203-0x0000000005AE0000-0x0000000005B56000-memory.dmp

Filesize
472KB

Download
memory/3920-202-0x0000000004F50000-0x0000000004FB6000-memory.dmp

Filesize
408KB

Download
memory/3920-153-0x0000000000630000-0x0000000000650000-memory.dmp

Filesize
128KB

Download
memory/4416-177-0x00007FFFA51E0000-0x00007FFFA51E1000-memory.dmp

Filesize
4KB

Download
memory/4724-146-0x0000022E230D3000-0x0000022E230D5000-memory.dmp

Filesize
8KB

Download
memory/4724-148-0x0000022E230D7000-0x0000022E230D9000-memory.dmp

Filesize
8KB

Download
memory/4724-163-0x0000022E246E0000-0x0000022E246EA000-memory.dmp

Filesize
40KB

Download
memory/4724-130-0x0000022E08B70000-0x0000022E08B90000-memory.dmp

Filesize
128KB

Download
memory/4724-135-0x00007FFF87850000-0x00007FFF88311000-memory.dmp

Filesize
10.8MB

Download
memory/4724-161-0x0000022E245D4000-0x0000022E245D7000-memory.dmp

Filesize
12KB

Download
memory/4724-136-0x0000022E230D0000-0x0000022E230D2000-memory.dmp

Filesize
8KB

Download
memory/4724-162-0x0000022E245D7000-0x0000022E245DC000-memory.dmp

Filesize
20KB

Download
memory/4724-147-0x0000022E230D5000-0x0000022E230D7000-memory.dmp

Filesize
8KB

Download
memory/4724-150-0x0000022E230D9000-0x0000022E230DF000-memory.dmp

Filesize
24KB

Download
memory/4724-159-0x0000022E245D0000-0x0000022E245D4000-memory.dmp

Filesize
16KB

Download
memory/4928-171-0x00000276E6BB0000-0x00000276E6BD2000-memory.dmp

Filesize
136KB

Download
memory/4928-170-0x00000276E6C63000-0x00000276E6C65000-memory.dmp

Filesize
8KB

Download
memory/4928-167-0x00007FFF87850000-0x00007FFF88311000-memory.dmp

Filesize
10.8MB

Download
memory/4928-169-0x00000276E6C60000-0x00000276E6C62000-memory.dmp

Filesize
8KB

Download