darkcomet | f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429

Analysis

max time kernel
152s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe
Size 935KB
Sample221004-belpjsehd2
SHA256 f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429
MD5 39155d3cb3f7297e02c78e8de64e0060
SHA1 3a8825b7168b837d5388f5b26b24ea950169f131
SHA512 30d2d6237964da7af8fa9b89ef2168c471f5cd9a504ca2d777bdf361b813c8be21763d89f5ad92fc9ee1e1cf1104d41ee16b75b37934fce5544977a57c82c8a4
SSDEEP 24576:n4t9MIPPE/RaPtUPYh31XyGb7govmIa1x3c:K0/R0tkA1fgUmIix
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet njrat hacked rat microsoft persistence phishing rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

liorhadad.no-ip.info:1300
46.116.152.219:1300
85.64.54.170:1300

Mutex

DC_MUTEX-69QBQR9

Attributes

gencode
6GuJmgpzwFpe
install
false
offline_keylogger
true
password
123456s
persistence
false

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

mark3000011.no-ip.biz:1177

Mutex

b5857819bb096c04134249d6f4e71934

Attributes

reg_key
b5857819bb096c04134249d6f4e71934
splitter
|'|'|

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 1 IoCs

pid	Process
4336	gg.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	gg.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe"	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe"	gg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4920 set thread context of 2560	4920	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe	95
PID 4336 set thread context of 3108	4336	gg.exe	94

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4610e7ef-827e-4e8c-a6b2-73bcbece0155.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221004055551.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	gg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
916	msedge.exe
916	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe
Token: SeDebugPrivilege	4336	gg.exe
Token: SeIncreaseQuotaPrivilege	3108	cvtres.exe
Token: SeSecurityPrivilege	3108	cvtres.exe
Token: SeTakeOwnershipPrivilege	3108	cvtres.exe
Token: SeLoadDriverPrivilege	3108	cvtres.exe
Token: SeSystemProfilePrivilege	3108	cvtres.exe
Token: SeSystemtimePrivilege	3108	cvtres.exe
Token: SeProfSingleProcessPrivilege	3108	cvtres.exe
Token: SeIncBasePriorityPrivilege	3108	cvtres.exe
Token: SeCreatePagefilePrivilege	3108	cvtres.exe
Token: SeBackupPrivilege	3108	cvtres.exe
Token: SeRestorePrivilege	3108	cvtres.exe
Token: SeShutdownPrivilege	3108	cvtres.exe
Token: SeDebugPrivilege	3108	cvtres.exe
Token: SeSystemEnvironmentPrivilege	3108	cvtres.exe
Token: SeChangeNotifyPrivilege	3108	cvtres.exe
Token: SeRemoteShutdownPrivilege	3108	cvtres.exe
Token: SeUndockPrivilege	3108	cvtres.exe
Token: SeManageVolumePrivilege	3108	cvtres.exe
Token: SeImpersonatePrivilege	3108	cvtres.exe
Token: SeCreateGlobalPrivilege	3108	cvtres.exe
Token: 33	3108	cvtres.exe
Token: 34	3108	cvtres.exe
Token: 35	3108	cvtres.exe
Token: 36	3108	cvtres.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3108	cvtres.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 4336	4920	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe	89
PID 4920 wrote to memory of 4336	4920	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe	89
PID 4920 wrote to memory of 4336	4920	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe	89
PID 4920 wrote to memory of 4192	4920	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe	92
PID 4920 wrote to memory of 4192	4920	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe	92
PID 4920 wrote to memory of 4192	4920	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe	92
PID 4336 wrote to memory of 3368	4336	gg.exe	93
PID 4336 wrote to memory of 3368	4336	gg.exe	93
PID 4336 wrote to memory of 3368	4336	gg.exe	93
PID 4336 wrote to memory of 3108	4336	gg.exe	94
PID 4336 wrote to memory of 3108	4336	gg.exe	94
PID 4336 wrote to memory of 3108	4336	gg.exe	94
PID 4920 wrote to memory of 2560	4920	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe	95
PID 4920 wrote to memory of 2560	4920	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe	95
PID 4920 wrote to memory of 2560	4920	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe	95
PID 4336 wrote to memory of 3108	4336	gg.exe	94
PID 4920 wrote to memory of 2560	4920	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe	95
PID 4920 wrote to memory of 2560	4920	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe	95
PID 4920 wrote to memory of 2560	4920	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe	95
PID 4920 wrote to memory of 2560	4920	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe	95
PID 4920 wrote to memory of 2560	4920	f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe	95
PID 4336 wrote to memory of 3108	4336	gg.exe	94
PID 4336 wrote to memory of 3108	4336	gg.exe	94
PID 4336 wrote to memory of 3108	4336	gg.exe	94
PID 4336 wrote to memory of 3108	4336	gg.exe	94
PID 4336 wrote to memory of 3108	4336	gg.exe	94
PID 4336 wrote to memory of 3108	4336	gg.exe	94
PID 4336 wrote to memory of 3108	4336	gg.exe	94
PID 4336 wrote to memory of 3108	4336	gg.exe	94
PID 4336 wrote to memory of 3108	4336	gg.exe	94
PID 4336 wrote to memory of 3108	4336	gg.exe	94
PID 2560 wrote to memory of 4584	2560	cvtres.exe	96
PID 2560 wrote to memory of 4584	2560	cvtres.exe	96
PID 2560 wrote to memory of 1320	2560	cvtres.exe	97
PID 2560 wrote to memory of 1320	2560	cvtres.exe	97
PID 1320 wrote to memory of 1800	1320	msedge.exe	99
PID 1320 wrote to memory of 1800	1320	msedge.exe	99
PID 4584 wrote to memory of 1780	4584	msedge.exe	98
PID 4584 wrote to memory of 1780	4584	msedge.exe	98
PID 4584 wrote to memory of 3588	4584	msedge.exe	103
PID 4584 wrote to memory of 3588	4584	msedge.exe	103
PID 1320 wrote to memory of 4904	1320	msedge.exe	102
PID 1320 wrote to memory of 4904	1320	msedge.exe	102
PID 4584 wrote to memory of 3588	4584	msedge.exe	103
PID 4584 wrote to memory of 3588	4584	msedge.exe	103
PID 4584 wrote to memory of 3588	4584	msedge.exe	103
PID 4584 wrote to memory of 3588	4584	msedge.exe	103
PID 4584 wrote to memory of 3588	4584	msedge.exe	103
PID 1320 wrote to memory of 4904	1320	msedge.exe	102
PID 4584 wrote to memory of 3588	4584	msedge.exe	103
PID 4584 wrote to memory of 3588	4584	msedge.exe	103
PID 4584 wrote to memory of 3588	4584	msedge.exe	103
PID 1320 wrote to memory of 4904	1320	msedge.exe	102
PID 4584 wrote to memory of 3588	4584	msedge.exe	103
PID 1320 wrote to memory of 4904	1320	msedge.exe	102
PID 4584 wrote to memory of 3588	4584	msedge.exe	103
PID 4584 wrote to memory of 3588	4584	msedge.exe	103
PID 4584 wrote to memory of 3588	4584	msedge.exe	103
PID 1320 wrote to memory of 4904	1320	msedge.exe	102
PID 4584 wrote to memory of 3588	4584	msedge.exe	103
PID 1320 wrote to memory of 4904	1320	msedge.exe	102
PID 4584 wrote to memory of 3588	4584	msedge.exe	103
PID 1320 wrote to memory of 4904	1320	msedge.exe	102
PID 4584 wrote to memory of 3588	4584	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe
"C:\Users\Admin\AppData\Local\Temp\f07ba8bfcdcfa52a20e341a6d22b8f6d3ed668e947d33770b02e7d391a2aa429.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\gg.exe
  "C:\Users\Admin\AppData\Local\Temp\gg.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\RmhOmkR.vbs"
    3⤵
    PID:3368
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    \Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3108
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\JSQXPWJM.vbs"
  2⤵
  PID:4192
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
  \Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=cvtres.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8aa4d46f8,0x7ff8aa4d4708,0x7ff8aa4d4718
      4⤵
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,17679584759006476829,4323120913604263561,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
      4⤵
      PID:3588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,17679584759006476829,4323120913604263561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=cvtres.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Adds Run key to start application
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8aa4d46f8,0x7ff8aa4d4708,0x7ff8aa4d4718
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11147650389012765598,6347920192322882972,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,11147650389012765598,6347920192322882972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,11147650389012765598,6347920192322882972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11147650389012765598,6347920192322882972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11147650389012765598,6347920192322882972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11147650389012765598,6347920192322882972,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
      4⤵
      PID:3976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,11147650389012765598,6347920192322882972,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5432 /prefetch:8
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11147650389012765598,6347920192322882972,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11147650389012765598,6347920192322882972,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,11147650389012765598,6347920192322882972,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5504 /prefetch:8
      4⤵
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11147650389012765598,6347920192322882972,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
      4⤵
      PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11147650389012765598,6347920192322882972,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
      4⤵
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11147650389012765598,6347920192322882972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
      4⤵
      PID:3484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:1416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff78f545460,0x7ff78f545470,0x7ff78f545480
        5⤵
        
        PID:4768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE
Size 471B
SHA256 81f0783a49afce7c284a0b9099f45a646694fdd67ce33a5e275aa461262a1d44
MD5 dcb650a933b718c9e345f34b03dcf176
SHA1 5d685186371b16d6c48a076fabcf9b43ad821b3e
SHA512 e4a8e165fa3166b52e941559ed50c49e13f7a28e181338cea892b448f31eb5ded74e35584386b853d17a1817294a64888da69acb8170d35c46288f2ec8323ce7
MD5 SHA1 SHA512

Submit Download

80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE
Size 416B
SHA256 958f3198d0f0fffe23ab372d631ef7e09033d3d54b2da35738723787cdb83698
MD5 8a3a185233c52431f1ffdc1d0a537187
SHA1 43f0872fe538920b17a057a9c4b46798be3c25ed
SHA512 9ded9eaca7be4fee4d8764174c02aa124609bc83eb78d5089ad209677552d9348bbe5fceec3e823f74e403fc2c7ff853244c76c200034545cc964d59a7931e7d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 54961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
MD5 727230d7b0f8df1633bc043529f5c15d
SHA1 5b24d959d4c5dcf8125125dbee37225d6160af18
SHA512 35735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 54961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
MD5 727230d7b0f8df1633bc043529f5c15d
SHA1 5b24d959d4c5dcf8125125dbee37225d6160af18
SHA512 35735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85
MD5 7b4b103831d353776ed8bfcc7676f9df
SHA1 40f33a3f791fda49a35224a469cc67b94ca53a23
SHA512 5cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85
MD5 7b4b103831d353776ed8bfcc7676f9df
SHA1 40f33a3f791fda49a35224a469cc67b94ca53a23
SHA512 5cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 21b9d3b827a2445f0fb28fdfad63ba0f1423006c865e1cfbc582debd5a636f07
MD5 d7efc72c10e0c7fd415bca4fe831284a
SHA1 ee9be971793720a0d98c3176c9a4f2a5358740f8
SHA512 f47ba7f107c1d9d0b54eee97250bba6e29e7c783f563f6b7046eb1c510ae54a8e343c9888cd71f1d0914f28defab9fdb5a6eb26a83222c68f93eb56c27f67018
MD5 SHA1 SHA512

Submit Download

Windows.exe

Path C:\Users\Admin\AppData\Local\Temp\Windows.exe
Size 782KB
SHA256 8fda0b6082e33d1ed269fe21226fc292e684464a3e3c8c2a84709a84f78ca2c8
MD5 33494ef99ed1250e796947c370876f46
SHA1 2b68d4796c608ee0bf794afbee7514b8773a1bbd
SHA512 e161edd77f3ee5bd9d8071c371d4296da25a1546a0e693b598fd2bc66456a786fd3f86c1908747f6a5d8dc81fd1e3054d10a0430fbac385d672a3069a41cbcc9
SSDEEP 24576:yt9MIPPE/RaPtUPYh31XyGb7govmIa1x3c:k0/R0tkA1fgUmIix
MD5 SHA1 SHA512 SSDEEP

Submit Download

gg.exe

Path C:\Users\Admin\AppData\Local\Temp\gg.exe
Size 782KB
SHA256 8fda0b6082e33d1ed269fe21226fc292e684464a3e3c8c2a84709a84f78ca2c8
MD5 33494ef99ed1250e796947c370876f46
SHA1 2b68d4796c608ee0bf794afbee7514b8773a1bbd
SHA512 e161edd77f3ee5bd9d8071c371d4296da25a1546a0e693b598fd2bc66456a786fd3f86c1908747f6a5d8dc81fd1e3054d10a0430fbac385d672a3069a41cbcc9
SSDEEP 24576:yt9MIPPE/RaPtUPYh31XyGb7govmIa1x3c:k0/R0tkA1fgUmIix
MD5 SHA1 SHA512 SSDEEP

Submit Download

gg.exe

Path C:\Users\Admin\AppData\Local\Temp\gg.exe
Size 782KB
SHA256 8fda0b6082e33d1ed269fe21226fc292e684464a3e3c8c2a84709a84f78ca2c8
MD5 33494ef99ed1250e796947c370876f46
SHA1 2b68d4796c608ee0bf794afbee7514b8773a1bbd
SHA512 e161edd77f3ee5bd9d8071c371d4296da25a1546a0e693b598fd2bc66456a786fd3f86c1908747f6a5d8dc81fd1e3054d10a0430fbac385d672a3069a41cbcc9
SSDEEP 24576:yt9MIPPE/RaPtUPYh31XyGb7govmIa1x3c:k0/R0tkA1fgUmIix
MD5 SHA1 SHA512 SSDEEP

Submit Download

JSQXPWJM.vbs

Path C:\Users\Admin\AppData\Roaming\JSQXPWJM.vbs
Size 455B
SHA256 d177dcdf8e1a430a76b95977ef590659bb6f9bb0dd0ed9ecb142351235f786db
MD5 e0d1baab1e00cf58f684cc15f81891af
SHA1 7a192fe8a1b1541710cf9535a6384465f8d079bc
SHA512 c66888e2a2cb609d208bbdfc56d9592d1c564546b56311adb5a53adc79ce2f1ffce2a0c06eb905c5a6b81d04afbc45d0454b28ae703246054a2e1f4285e319b7
MD5 SHA1 SHA512

Submit Download

RmhOmkR.vbs

Path C:\Users\Admin\AppData\Roaming\RmhOmkR.vbs
Size 382B
SHA256 430bdb234f4ca075ca59d6badd4645d05d530345ee6a9d64bef48c902dc697c4
MD5 21fb6b9c51805fdf6f439ad5689b70d4
SHA1 f3c90a8517f976025f255808085b4651c46c81a5
SHA512 939f50febe6a693b66fe8b436c623321497d6fcc4ea247955e6dcf83c9bc0ab90c5203aa9496eb4d9cd88e8647cd1d05bee798a4c5093bde9063483768a246b9
MD5 SHA1 SHA512

Submit Download

memory/2560-143-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3108-152-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3108-153-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3108-148-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3108-145-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3108-144-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4336-151-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/4336-138-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/4336-137-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/4920-133-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/4920-132-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/4920-149-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download