remcos | 2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859

General

Target

2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
Size

825KB
MD5

9413943e4f3fdbed52a79bcf0c600490
SHA1

e88c67859b398f0cc10f7e9adc648848643623f4
SHA256

2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859
SHA512

6593946e73bb708cdfd2b6ea3b2346e02551d1e4c816eef8c276af4083ab56bbcbfeb9599ee1228e8081f61f907eebc542c02af4d62914350e9fdaa27efe7012
SSDEEP

24576:bM+L74mBfNUstzo7vRgwLiTcToZJynxRiq3r8JN:QRFiT5ZJK71I

Score

10^/10

remcos nov 22nd microsoft evasion persistence phishing rat trojan

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Nov 22nd

C2

gcrozona.duckdns.org:3030

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
Microsoft Intel Audios.exe
copy_folder
Audio Microsoft File
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%WinDir%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Windows Display
keylog_path
%WinDir%
mouse_option
false
mutex
Windows Audio
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
Window Security Check
take_screenshot_option
true
take_screenshot_time
5
take_screenshot_title
Username;password;proforma;invoice;notepad

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Executes dropped EXE 3 IoCs

Processes:

Microsoft Intel Audios.exeMicrosoft Intel Audios.exeMicrosoft Intel Audios.exe

pid process

4424 Microsoft Intel Audios.exe
3980 Microsoft Intel Audios.exe
3360 Microsoft Intel Audios.exe

pid	process
4424	Microsoft Intel Audios.exe
3980	Microsoft Intel Audios.exe
3360	Microsoft Intel Audios.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exeMicrosoft Intel Audios.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Window Security Check = "\"C:\\Windows\\Audio Microsoft File\\Microsoft Intel Audios.exe\""	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Microsoft Intel Audios.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Window Security Check = "\"C:\\Windows\\Audio Microsoft File\\Microsoft Intel Audios.exe\""	Microsoft Intel Audios.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 3 IoCs

Processes:

2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exeMicrosoft Intel Audios.exeMicrosoft Intel Audios.exe

description	pid	process	target process
PID 4640 set thread context of 4524	4640	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
PID 4424 set thread context of 3360	4424	Microsoft Intel Audios.exe	Microsoft Intel Audios.exe
PID 3360 set thread context of 4000	3360	Microsoft Intel Audios.exe	iexplore.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\251037d8-bcb0-4986-a7ed-08ba5e16dcad.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221122030008.pma	setup.exe

Drops file in Windows directory 3 IoCs

Processes:

2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe

description	ioc	process
File created	C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
File opened for modification	C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
File opened for modification	C:\Windows\Audio Microsoft File	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe
Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

8 reg.exe
652 reg.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1872 PING.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

pid	process
8	reg.exe
652	reg.exe

pid	process
1872	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exeMicrosoft Intel Audios.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
4640	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
4640	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
4424	Microsoft Intel Audios.exe
4424	Microsoft Intel Audios.exe
964	msedge.exe
964	msedge.exe
2100	msedge.exe
2100	msedge.exe
4792	identity_helper.exe
4792	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2100 msedge.exe
2100 msedge.exe
2100 msedge.exe
2100 msedge.exe
2100 msedge.exe
2100 msedge.exe
2100 msedge.exe

pid	process
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exeMicrosoft Intel Audios.exe

description	pid	process
Token: SeDebugPrivilege	4640	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
Token: SeDebugPrivilege	4424	Microsoft Intel Audios.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msedge.exe

pid process

2100 msedge.exe
2100 msedge.exe
2100 msedge.exe

pid	process
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.execmd.execmd.exeMicrosoft Intel Audios.exeMicrosoft Intel Audios.execmd.exeiexplore.exemsedge.exe

description	pid	process	target process
PID 4640 wrote to memory of 4868	4640	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
PID 4640 wrote to memory of 4868	4640	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
PID 4640 wrote to memory of 4868	4640	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
PID 4640 wrote to memory of 4524	4640	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
PID 4640 wrote to memory of 4524	4640	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
PID 4640 wrote to memory of 4524	4640	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
PID 4640 wrote to memory of 4524	4640	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
PID 4640 wrote to memory of 4524	4640	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
PID 4640 wrote to memory of 4524	4640	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
PID 4640 wrote to memory of 4524	4640	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
PID 4640 wrote to memory of 4524	4640	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
PID 4640 wrote to memory of 4524	4640	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
PID 4524 wrote to memory of 1772	4524	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	cmd.exe
PID 4524 wrote to memory of 1772	4524	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	cmd.exe
PID 4524 wrote to memory of 1772	4524	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	cmd.exe
PID 1772 wrote to memory of 652	1772	cmd.exe	reg.exe
PID 1772 wrote to memory of 652	1772	cmd.exe	reg.exe
PID 1772 wrote to memory of 652	1772	cmd.exe	reg.exe
PID 4524 wrote to memory of 4328	4524	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	cmd.exe
PID 4524 wrote to memory of 4328	4524	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	cmd.exe
PID 4524 wrote to memory of 4328	4524	2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe	cmd.exe
PID 4328 wrote to memory of 1872	4328	cmd.exe	PING.EXE
PID 4328 wrote to memory of 1872	4328	cmd.exe	PING.EXE
PID 4328 wrote to memory of 1872	4328	cmd.exe	PING.EXE
PID 4328 wrote to memory of 4424	4328	cmd.exe	Microsoft Intel Audios.exe
PID 4328 wrote to memory of 4424	4328	cmd.exe	Microsoft Intel Audios.exe
PID 4328 wrote to memory of 4424	4328	cmd.exe	Microsoft Intel Audios.exe
PID 4424 wrote to memory of 3980	4424	Microsoft Intel Audios.exe	Microsoft Intel Audios.exe
PID 4424 wrote to memory of 3980	4424	Microsoft Intel Audios.exe	Microsoft Intel Audios.exe
PID 4424 wrote to memory of 3980	4424	Microsoft Intel Audios.exe	Microsoft Intel Audios.exe
PID 4424 wrote to memory of 3360	4424	Microsoft Intel Audios.exe	Microsoft Intel Audios.exe
PID 4424 wrote to memory of 3360	4424	Microsoft Intel Audios.exe	Microsoft Intel Audios.exe
PID 4424 wrote to memory of 3360	4424	Microsoft Intel Audios.exe	Microsoft Intel Audios.exe
PID 4424 wrote to memory of 3360	4424	Microsoft Intel Audios.exe	Microsoft Intel Audios.exe
PID 4424 wrote to memory of 3360	4424	Microsoft Intel Audios.exe	Microsoft Intel Audios.exe
PID 4424 wrote to memory of 3360	4424	Microsoft Intel Audios.exe	Microsoft Intel Audios.exe
PID 4424 wrote to memory of 3360	4424	Microsoft Intel Audios.exe	Microsoft Intel Audios.exe
PID 4424 wrote to memory of 3360	4424	Microsoft Intel Audios.exe	Microsoft Intel Audios.exe
PID 4424 wrote to memory of 3360	4424	Microsoft Intel Audios.exe	Microsoft Intel Audios.exe
PID 3360 wrote to memory of 4260	3360	Microsoft Intel Audios.exe	cmd.exe
PID 3360 wrote to memory of 4260	3360	Microsoft Intel Audios.exe	cmd.exe
PID 3360 wrote to memory of 4260	3360	Microsoft Intel Audios.exe	cmd.exe
PID 3360 wrote to memory of 4000	3360	Microsoft Intel Audios.exe	iexplore.exe
PID 3360 wrote to memory of 4000	3360	Microsoft Intel Audios.exe	iexplore.exe
PID 3360 wrote to memory of 4000	3360	Microsoft Intel Audios.exe	iexplore.exe
PID 3360 wrote to memory of 4000	3360	Microsoft Intel Audios.exe	iexplore.exe
PID 3360 wrote to memory of 4000	3360	Microsoft Intel Audios.exe	iexplore.exe
PID 3360 wrote to memory of 4000	3360	Microsoft Intel Audios.exe	iexplore.exe
PID 3360 wrote to memory of 4000	3360	Microsoft Intel Audios.exe	iexplore.exe
PID 3360 wrote to memory of 4000	3360	Microsoft Intel Audios.exe	iexplore.exe
PID 4260 wrote to memory of 8	4260	cmd.exe	reg.exe
PID 4260 wrote to memory of 8	4260	cmd.exe	reg.exe
PID 4260 wrote to memory of 8	4260	cmd.exe	reg.exe
PID 4000 wrote to memory of 2100	4000	iexplore.exe	msedge.exe
PID 4000 wrote to memory of 2100	4000	iexplore.exe	msedge.exe
PID 2100 wrote to memory of 2120	2100	msedge.exe	msedge.exe
PID 2100 wrote to memory of 2120	2100	msedge.exe	msedge.exe
PID 2100 wrote to memory of 4304	2100	msedge.exe	msedge.exe
PID 2100 wrote to memory of 4304	2100	msedge.exe	msedge.exe
PID 2100 wrote to memory of 4304	2100	msedge.exe	msedge.exe
PID 2100 wrote to memory of 4304	2100	msedge.exe	msedge.exe
PID 2100 wrote to memory of 4304	2100	msedge.exe	msedge.exe
PID 2100 wrote to memory of 4304	2100	msedge.exe	msedge.exe
PID 2100 wrote to memory of 4304	2100	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
"C:\Users\Admin\AppData\Local\Temp\2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640

C:\Users\Admin\AppData\Local\Temp\2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
"C:\Users\Admin\AppData\Local\Temp\2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe"
2⤵
PID:4868

C:\Users\Admin\AppData\Local\Temp\2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe
"C:\Users\Admin\AppData\Local\Temp\2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859.exe"
2⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4524

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
3⤵
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
4⤵
- UAC bypass
- Modifies registry key
PID:652

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:4328

C:\Windows\SysWOW64\PING.EXE
PING 127.0.0.1 -n 2
4⤵
- Runs ping.exe
PID:1872

C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe
"C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424

C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe
"C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe"
5⤵
- Executes dropped EXE
PID:3980

C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe
"C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3360

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
6⤵
- Suspicious use of WriteProcessMemory
PID:4260

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
7⤵
- UAC bypass
- Modifies registry key
PID:8

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
6⤵
- Suspicious use of WriteProcessMemory
PID:4000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
7⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd7ed746f8,0x7ffd7ed74708,0x7ffd7ed74718
8⤵
PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16557979139255495801,4986586287851149899,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
8⤵
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,16557979139255495801,4986586287851149899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
8⤵
- Suspicious behavior: EnumeratesProcesses
PID:964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,16557979139255495801,4986586287851149899,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
8⤵
PID:1040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16557979139255495801,4986586287851149899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
8⤵
PID:828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16557979139255495801,4986586287851149899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
8⤵
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,16557979139255495801,4986586287851149899,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4776 /prefetch:8
8⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16557979139255495801,4986586287851149899,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
8⤵
PID:4620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,16557979139255495801,4986586287851149899,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5500 /prefetch:8
8⤵
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16557979139255495801,4986586287851149899,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
8⤵
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16557979139255495801,4986586287851149899,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
8⤵
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16557979139255495801,4986586287851149899,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
8⤵
PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16557979139255495801,4986586287851149899,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
8⤵
PID:3460

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16557979139255495801,4986586287851149899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
8⤵
PID:2924

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
8⤵
- Drops file in Program Files directory
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe8,0xec,0xf0,0x12c,0x130,0x7ff6b40d5460,0x7ff6b40d5470,0x7ff6b40d5480
9⤵
PID:1212

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16557979139255495801,4986586287851149899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
8⤵
- Suspicious behavior: EnumeratesProcesses
PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
7⤵
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7ed746f8,0x7ffd7ed74708,0x7ffd7ed74718
8⤵
PID:2336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9227ba18e4106970788586689f7dddd7

SHA1
7e2c112b4b2f2fe7b5d308a2078dc487f8b50c7c

SHA256
01d0339bd0406e76af6bbce8ca4e41d6c0bb5e1ac9f5926f1e0627590880e481

SHA512
b0fafe3d9e1e5d7e8eb6ba258852ae1d1c9ffb04a6378703755a89e4575d3af1c2b88e5367e0868b7f1ea3ee7f9a76a1541a2846e583621ed495d1d97ff864da

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.bat

Filesize
109B

MD5
8ddcdd0ab01b0740982e7b78b1591015

SHA1
acbb9c4bb32822a164f200f8b77eda0ce7bd758d

SHA256
7c1abbf1a20f581d2db76d769cc14cf753a412cf92e383a36ffbf0c962eaf678

SHA512
ef43e3cb89c800529530183d4315782a864281ef8a0e6443a54ccc4f1837fcbfe43027b399bb43ea114fab70416d49b3cb2539cf8bf658b4b447c4e8597959dc

Download Submit
C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe

Filesize
825KB

MD5
9413943e4f3fdbed52a79bcf0c600490

SHA1
e88c67859b398f0cc10f7e9adc648848643623f4

SHA256
2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859

SHA512
6593946e73bb708cdfd2b6ea3b2346e02551d1e4c816eef8c276af4083ab56bbcbfeb9599ee1228e8081f61f907eebc542c02af4d62914350e9fdaa27efe7012

Download Submit
C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe

Filesize
825KB

MD5
9413943e4f3fdbed52a79bcf0c600490

SHA1
e88c67859b398f0cc10f7e9adc648848643623f4

SHA256
2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859

SHA512
6593946e73bb708cdfd2b6ea3b2346e02551d1e4c816eef8c276af4083ab56bbcbfeb9599ee1228e8081f61f907eebc542c02af4d62914350e9fdaa27efe7012

Download Submit
C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe

Filesize
825KB

MD5
9413943e4f3fdbed52a79bcf0c600490

SHA1
e88c67859b398f0cc10f7e9adc648848643623f4

SHA256
2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859

SHA512
6593946e73bb708cdfd2b6ea3b2346e02551d1e4c816eef8c276af4083ab56bbcbfeb9599ee1228e8081f61f907eebc542c02af4d62914350e9fdaa27efe7012

Download Submit
C:\Windows\Audio Microsoft File\Microsoft Intel Audios.exe

Filesize
825KB

MD5
9413943e4f3fdbed52a79bcf0c600490

SHA1
e88c67859b398f0cc10f7e9adc648848643623f4

SHA256
2ce3863a4e824f825a7760ca9283a58c8b9483a5501e5b7a0578729736da7859

SHA512
6593946e73bb708cdfd2b6ea3b2346e02551d1e4c816eef8c276af4083ab56bbcbfeb9599ee1228e8081f61f907eebc542c02af4d62914350e9fdaa27efe7012

Download Submit
\??\pipe\LOCAL\crashpad_2100_MCVWKEUUEWQMZAMN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/8-161-0x0000000000000000-mapping.dmp

Download
memory/652-144-0x0000000000000000-mapping.dmp

Download
memory/828-171-0x0000000000000000-mapping.dmp

Download
memory/964-166-0x0000000000000000-mapping.dmp

Download
memory/1040-169-0x0000000000000000-mapping.dmp

Download
memory/1212-192-0x0000000000000000-mapping.dmp

Download
memory/1772-143-0x0000000000000000-mapping.dmp

Download
memory/1872-148-0x0000000000000000-mapping.dmp

Download
memory/2004-188-0x0000000000000000-mapping.dmp

Download
memory/2100-162-0x0000000000000000-mapping.dmp

Download
memory/2120-163-0x0000000000000000-mapping.dmp

Download
memory/2336-185-0x0000000000000000-mapping.dmp

Download
memory/2380-173-0x0000000000000000-mapping.dmp

Download
memory/3008-179-0x0000000000000000-mapping.dmp

Download
memory/3360-154-0x0000000000000000-mapping.dmp

Download
memory/3360-158-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3360-160-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3460-190-0x0000000000000000-mapping.dmp

Download
memory/3608-184-0x0000000000000000-mapping.dmp

Download
memory/3980-152-0x0000000000000000-mapping.dmp

Download
memory/4192-191-0x0000000000000000-mapping.dmp

Download
memory/4260-159-0x0000000000000000-mapping.dmp

Download
memory/4304-165-0x0000000000000000-mapping.dmp

Download
memory/4328-145-0x0000000000000000-mapping.dmp

Download
memory/4424-149-0x0000000000000000-mapping.dmp

Download
memory/4524-139-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4524-146-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4524-142-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4524-141-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4524-138-0x0000000000000000-mapping.dmp

Download
memory/4564-175-0x0000000000000000-mapping.dmp

Download
memory/4620-177-0x0000000000000000-mapping.dmp

Download
memory/4640-136-0x0000000008190000-0x000000000822C000-memory.dmp

Filesize
624KB

Download
memory/4640-132-0x0000000000C60000-0x0000000000D34000-memory.dmp

Filesize
848KB

Download
memory/4640-135-0x0000000005780000-0x000000000578A000-memory.dmp

Filesize
40KB

Download
memory/4640-134-0x00000000056D0000-0x0000000005762000-memory.dmp

Filesize
584KB

Download
memory/4640-133-0x0000000005D60000-0x0000000006304000-memory.dmp

Filesize
5.6MB

Download
memory/4720-183-0x0000000000000000-mapping.dmp

Download
memory/4792-193-0x0000000000000000-mapping.dmp

Download
memory/4868-137-0x0000000000000000-mapping.dmp

Download
memory/4884-181-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads