nanocore | 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d

Analysis

max time kernel
151s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 23:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
Size 1.1MB
Sample221126-3nar7add32
SHA256 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d
MD5 75342cdd702056910a3fce3b434cf1b1
SHA1 02728d0ad5e5c1f34ee3bd77bb7af144f83438f9
SHA512 dd6dc0a07f0ffbbf0793c3e97d86de80720e6dca0216441b3ab46014975e186b975887a8cde3530b7a43fcbc078788ebe8df5fd065c0ac5779b98febaf7409ec
SSDEEP 24576:Ktb20pkaCqT5TBWgNQ7aulZsRTXRDL6nY935ZSS6A:3Vg5tQ7aulZsRTXRD/55
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore microsoft keylogger persistence phishing spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

moftsvs.ig42.org:9045
212.7.192.242:9045

Mutex

c7bf44a3-7212-4d60-9ee3-f0991c8392f8

Attributes

activate_away_mode
false
backup_connection_host
212.7.192.242
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2015-03-06T14:55:41.478810836Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
9045
default_group
Default Team
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
c7bf44a3-7212-4d60-9ee3-f0991c8392f8
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
moftsvs.ig42.org
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe"	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4976 set thread context of 4852	4976	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe	84

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\646b890e-56a4-4aa3-bb0a-c2ea9f964066.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221127180609.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1832	msedge.exe
1832	msedge.exe
4432	msedge.exe
4432	msedge.exe
3112	msedge.exe
3112	msedge.exe
2192	identity_helper.exe
2192	identity_helper.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2348	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
2348	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
2348	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
2348	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
4976	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
4976	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
4976	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2348	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
2348	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
2348	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
2348	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
4976	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
4976	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
4976	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 4976	2348	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe	82
PID 2348 wrote to memory of 4976	2348	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe	82
PID 2348 wrote to memory of 4976	2348	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe	82
PID 4976 wrote to memory of 4852	4976	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe	84
PID 4976 wrote to memory of 4852	4976	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe	84
PID 4976 wrote to memory of 4852	4976	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe	84
PID 4976 wrote to memory of 4852	4976	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe	84
PID 4976 wrote to memory of 4852	4976	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe	84
PID 4976 wrote to memory of 4852	4976	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe	84
PID 4976 wrote to memory of 4852	4976	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe	84
PID 4976 wrote to memory of 4852	4976	742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe	84
PID 3112 wrote to memory of 4492	3112	msedge.exe	86
PID 3112 wrote to memory of 4492	3112	msedge.exe	86
PID 4588 wrote to memory of 3900	4588	msedge.exe	90
PID 4588 wrote to memory of 3900	4588	msedge.exe	90
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 3772	3112	msedge.exe	91
PID 3112 wrote to memory of 1832	3112	msedge.exe	92
PID 3112 wrote to memory of 1832	3112	msedge.exe	92
PID 3112 wrote to memory of 4756	3112	msedge.exe	93
PID 3112 wrote to memory of 4756	3112	msedge.exe	93
PID 3112 wrote to memory of 4756	3112	msedge.exe	93
PID 3112 wrote to memory of 4756	3112	msedge.exe	93
PID 3112 wrote to memory of 4756	3112	msedge.exe	93
PID 3112 wrote to memory of 4756	3112	msedge.exe	93
PID 3112 wrote to memory of 4756	3112	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
"C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
  "C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\lf2" "C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe" "742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\SysWOW64\WerFault.exe
    "C:\Windows\SysWOW64\WerFault.exe"
    3⤵
    PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WerFault.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
      4⤵
      Adds Run key to start application
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x9c,0x7fff264546f8,0x7fff26454708,0x7fff26454718
        5⤵
        
        PID:4492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
        5⤵
        
        PID:3772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
        5⤵
        
        PID:4756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
        5⤵
        
        PID:4908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
        5⤵
        
        PID:4772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
        5⤵
        
        PID:4196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5376 /prefetch:8
        5⤵
        
        PID:4844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
        5⤵
        
        PID:904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
        5⤵
        
        PID:2508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5904 /prefetch:8
        5⤵
        
        PID:3140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
        5⤵
        
        PID:3596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
        5⤵
        
        PID:2256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:8
        5⤵
        
        PID:804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        Drops file in Program Files directory
        
        PID:2344
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7e4a65460,0x7ff7e4a65470,0x7ff7e4a65480
        6⤵
        
        PID:800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6744 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WerFault.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff264546f8,0x7fff26454708,0x7fff26454718
        5⤵
        
        PID:3900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,13604194932714758585,14896589861932787475,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
        5⤵
        
        PID:4808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,13604194932714758585,14896589861932787475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
Size 471B
SHA256 b43ab742a745a5293b46de337819f22995835f52e29656ff8fb2eb5a1f569229
MD5 8212d70c86ce431d59072c64f70a8279
SHA1 b221f0de1fb741bff50d0536566f1a9602757ee1
SHA512 08925c1502691ca0eebc03dcf82ba0efba59a3c480edbe7ace5632fcd2cb4d03895bb3babd41effa627b162bd3d88d51b8daeeadd657e49d39b4ebb202281d0e
MD5 SHA1 SHA512

Submit Download

80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
Size 412B
SHA256 cc2e41a8086eb84d9dcdfbbd3b4eb9e33d8bab2978da4c07e7abe71127243ee4
MD5 a69e4ee0072e3cb212e468f14886311a
SHA1 b84d2ca5e7225b91520f339e177aff66428eef45
SHA512 75875cddcccae57c29c23ad379785b02d547dea833a9efb38374d63b0d7a9e41dc3b6e6160b0744ab9c83e33dabc144dd9f704b1c338013a932c5a962a63d4fc
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2
MD5 af05481b81fdeb6c34b41fa28542b8e1
SHA1 30982103d4ad165cda1b492f96da553b0d5a8663
SHA512 6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
MD5 71b657795f1d63721f304fcf46915016
SHA1 d2cabf753a2b8888642a3a26878e7f47784153b2
SHA512 dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
MD5 71b657795f1d63721f304fcf46915016
SHA1 d2cabf753a2b8888642a3a26878e7f47784153b2
SHA512 dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 d2ce657b337b662618cd98db06cacf588e5740ed3eb2bea3b4692409a331a43a
MD5 243c3736c5a812414cf59bf5600d3f4d
SHA1 f52022f1d87b8777bf4c52aa49f7e4a50f809920
SHA512 ed507ee2ec851004e2b27eb16b1da05aa06848754c4adf2327f8802bf018d34822fba75049fb34d8a054387a9994900c86d5c41678155881460818d885e3dd77
MD5 SHA1 SHA512

Submit Download

ger

Path C:\Users\Admin\AppData\Local\Temp\ger
Size 202KB
SHA256 06538639dc35c0781397871581f21949a11afd5080d0f6a69b5c09c8d278cb8a
MD5 62cddffde88715a338548dbfa47b555c
SHA1 17d9eed664beee32f9fa62d61daaaac931885e51
SHA512 0fe70f5fae9ca1fee043b00bd0119dc1c5a7055881c1ed91a725a8cf7476c365e0b0d621ce35b5e6ff9e07687e5fa8901c47c4496297723288b10b39bbaa5442
SSDEEP 6144:BqAX9BlHSUG7pphWIICm3yK2wiYvZisBE8TWOi4MV9:BpXrlNapctCm3KwDIiE8TWOid
MD5 SHA1 SHA512 SSDEEP

Submit Download

lf2

Path C:\Users\Admin\AppData\Local\Temp\lf2
Size 5KB
SHA256 b513a4cace0f3b588f32baba51b487d774de220503746f56ae9a655737a6d532
MD5 4ff1ccdb9061a9ee17931de9cc506a0f
SHA1 18246065474565a991de8b76043dca47c6afb51a
SHA512 6de408adf1dd625fe2917771aac3fbe5c88b1342382ee608684940e928392752ee4d7917667d25542ce982f2f86c6e06f14c6accdccba14921978ab399750886
SSDEEP 96:bvzshTciHId9lk+16+p3mGHMlxxVqxo7SXcF8NCBlAR6NBlSRi5OPENv2VzNh/8d:HjUVRVq3NCcmBlSR2OPE52VzfStP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4852-136-0x0000000000400000-0x0000000000438000-memory.dmp

Download