njrat | d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279

Analysis

max time kernel
170s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe
Size

873KB
MD5

592d7e07011a75a47ad84b4a0054222a
SHA1

a1e0f2ac27f6e9e749061b7070620c549b3769f2
SHA256

d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279
SHA512

cc8ae98b0fa0a46c10c71676007738ddd5867f6beb9ba0e748b7907a508b5f719014e4c4855f72ff5f15808f286daf17c5853134a432b5d4715f0502af5de0fc
SSDEEP

12288:Ztb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSga1lSOD6A:Ztb20pkaCqT5TBWgNQ7aXSOD6A

Score

10^/10

njrat em microsoft persistence phishing trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

markben390.no-ip.org:1337

Mutex

9fef715de4fae73de5b4a6c7f69fe158

Attributes

reg_key
9fef715de4fae73de5b4a6c7f69fe158
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

sample.exesample.exe

pid process

3644 sample.exe
3320 sample.exe

pid	process
3644	sample.exe
3320	sample.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

sample.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	sample.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\sample.exe"	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\sample.exe	autoit_exe
C:\Users\Admin\AppData\Roaming\sample.exe	autoit_exe
C:\Users\Admin\AppData\Roaming\sample.exe	autoit_exe

Detected potential entity reuse from brand microsoft.
phishing microsoft
Suspicious use of SetThreadContext 1 IoCs

Processes:

sample.exe

description pid process target process

PID 3320 set thread context of 1104 3320 sample.exe explorer.exe

description	pid	process	target process
PID 3320 set thread context of 1104	3320	sample.exe	explorer.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\9647c6d8-1dae-457f-8137-e13129293820.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221129233343.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2468 PING.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

pid	process
2468	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

sample.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3320	sample.exe
3320	sample.exe
1888	msedge.exe
1888	msedge.exe
3828	msedge.exe
3828	msedge.exe
4768	identity_helper.exe
4768	identity_helper.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3828 msedge.exe
3828 msedge.exe
3828 msedge.exe
3828 msedge.exe
3828 msedge.exe
3828 msedge.exe
3828 msedge.exe

pid	process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exesample.exemsedge.exe

pid	process
5068	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe
5068	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe
5068	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe
3644	sample.exe
3644	sample.exe
3644	sample.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of SendNotifyMessage 6 IoCs

Processes:

d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exesample.exe

pid	process
5068	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe
5068	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe
5068	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe
3644	sample.exe
3644	sample.exe
3644	sample.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exed7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exesample.execmd.exesample.exeexplorer.exemsedge.exe

description	pid	process	target process
PID 5068 wrote to memory of 4192	5068	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe
PID 5068 wrote to memory of 4192	5068	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe
PID 5068 wrote to memory of 4192	5068	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe
PID 4192 wrote to memory of 3644	4192	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe	sample.exe
PID 4192 wrote to memory of 3644	4192	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe	sample.exe
PID 4192 wrote to memory of 3644	4192	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe	sample.exe
PID 4192 wrote to memory of 2816	4192	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe	cmd.exe
PID 4192 wrote to memory of 2816	4192	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe	cmd.exe
PID 4192 wrote to memory of 2816	4192	d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe	cmd.exe
PID 3644 wrote to memory of 3320	3644	sample.exe	sample.exe
PID 3644 wrote to memory of 3320	3644	sample.exe	sample.exe
PID 3644 wrote to memory of 3320	3644	sample.exe	sample.exe
PID 2816 wrote to memory of 2468	2816	cmd.exe	PING.EXE
PID 2816 wrote to memory of 2468	2816	cmd.exe	PING.EXE
PID 2816 wrote to memory of 2468	2816	cmd.exe	PING.EXE
PID 3320 wrote to memory of 1104	3320	sample.exe	explorer.exe
PID 3320 wrote to memory of 1104	3320	sample.exe	explorer.exe
PID 3320 wrote to memory of 1104	3320	sample.exe	explorer.exe
PID 3320 wrote to memory of 1104	3320	sample.exe	explorer.exe
PID 3320 wrote to memory of 1104	3320	sample.exe	explorer.exe
PID 1104 wrote to memory of 3828	1104	explorer.exe	msedge.exe
PID 1104 wrote to memory of 3828	1104	explorer.exe	msedge.exe
PID 3828 wrote to memory of 2116	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 2116	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe
PID 3828 wrote to memory of 1060	3828	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe
"C:\Users\Admin\AppData\Local\Temp\d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5068

C:\Users\Admin\AppData\Local\Temp\d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe
C:\Users\Admin\AppData\Local\Temp\d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\b" "C:\Users\Admin\AppData\Local\Temp\d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4192

C:\Users\Admin\AppData\Roaming\sample.exe
"C:\Users\Admin\AppData\Roaming\sample.exe"
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3644

C:\Users\Admin\AppData\Roaming\sample.exe
C:\Users\Admin\AppData\Roaming\sample.exe /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\b" "C:\Users\Admin\AppData\Roaming\sample.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3320

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
6⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xb0,0xdc,0x100,0x38,0x104,0x7ffbffa346f8,0x7ffbffa34708,0x7ffbffa34718
7⤵
PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
7⤵
PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
7⤵
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
7⤵
PID:3916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
7⤵
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4732 /prefetch:8
7⤵
PID:1828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5420 /prefetch:8
7⤵
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
7⤵
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
7⤵
PID:1444

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3592 /prefetch:8
7⤵
PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
7⤵
- Drops file in Program Files directory
PID:720

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7487f5460,0x7ff7487f5470,0x7ff7487f5480
8⤵
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3592 /prefetch:8
7⤵
- Suspicious behavior: EnumeratesProcesses
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
7⤵
PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
7⤵
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
7⤵
PID:2456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1812 /prefetch:8
7⤵
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4912 /prefetch:8
7⤵
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5116 /prefetch:8
7⤵
PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1876 /prefetch:2
7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,4181114106809505550,14327871679712420442,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3240 /prefetch:8
7⤵
PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
6⤵
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbffa346f8,0x7ffbffa34708,0x7ffbffa34718
7⤵
PID:4916

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\98.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:2816

C:\Windows\SysWOW64\PING.EXE
ping -n 0127.0.0.1
4⤵
- Runs ping.exe
PID:2468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4848

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
9227ba18e4106970788586689f7dddd7

SHA1
7e2c112b4b2f2fe7b5d308a2078dc487f8b50c7c

SHA256
01d0339bd0406e76af6bbce8ca4e41d6c0bb5e1ac9f5926f1e0627590880e481

SHA512
b0fafe3d9e1e5d7e8eb6ba258852ae1d1c9ffb04a6378703755a89e4575d3af1c2b88e5367e0868b7f1ea3ee7f9a76a1541a2846e583621ed495d1d97ff864da

Download Submit
C:\Users\Admin\AppData\Local\Temp\98.bat
Filesize
178B

MD5
d8f7f00c64020587aef4eca527142641

SHA1
af0be1e29b1c8556d87bd69045a5ff99a3cef740

SHA256
0e6b1d16c9f74cca896c8bc5f7f6227850f2a567036b4051e2be1b87d4cfe795

SHA512
c441d70d56acc27b056c92a4eb85bd63a43080407d7fe7775f903a6bb0ed826e8145c85b3ba69ac7ce87581046c1aaedb61c6a7d8d9e73e8249b55fa40608122

Download Submit
C:\Users\Admin\AppData\Local\Temp\a
Filesize
18KB

MD5
f18121b898e05f564b846a37911bcf6b

SHA1
04e0d1b2a0ecb5533f5ca4597fbf9ef606f0cf39

SHA256
067d5b113825bc6c093aa4615773d936913030f219d46b3fed1a32e776aac3ee

SHA512
bed3cd08229cb909211a9b2b3f94fd9d161718f830dd80a9192d78c76b25533eb9436cc64f218d1bedc31bbb1d8fafcbcbfb60dfb587078be3dffe8b6cef89b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\b
Filesize
18KB

MD5
77d9d3140a39defd71f6986ffe6caf72

SHA1
f37f821dfc246db6ed000a1b4860f3b6447b1e49

SHA256
6813ccecb375f7885ff2f15ab735c4c1fd73201b2c60f709a2d616e870c8c5b2

SHA512
2bec4160fe9fc336c5ea3386942d48a3c3a3f95e39c709a5ff0dbbcf9ad806ad2846fec6060c86120d33228b9530e17860e30425cd8ab581aee6743efaefc154

Download Submit
C:\Users\Admin\AppData\Local\Temp\b
Filesize
18KB

MD5
77d9d3140a39defd71f6986ffe6caf72

SHA1
f37f821dfc246db6ed000a1b4860f3b6447b1e49

SHA256
6813ccecb375f7885ff2f15ab735c4c1fd73201b2c60f709a2d616e870c8c5b2

SHA512
2bec4160fe9fc336c5ea3386942d48a3c3a3f95e39c709a5ff0dbbcf9ad806ad2846fec6060c86120d33228b9530e17860e30425cd8ab581aee6743efaefc154

Download Submit
C:\Users\Admin\AppData\Local\Temp\incl1
Filesize
12KB

MD5
2ca76a6543e1e644d5eec2a8620149d2

SHA1
42a03dfd435742c27da9997f71df44f7ab7d3c8d

SHA256
4ed7f61d00ca189aa15394ddbbee18afb8196509b23ce736646dbca8a84d9f37

SHA512
247d42a210e6c1d5185e96e94942871a76df598f8faf07ee59bd7c40349210a07fe492865d9dbefd27965828d2deed50af0dd6a17e30c93196a43dccc3a01761

Download Submit
C:\Users\Admin\AppData\Local\Temp\incl1
Filesize
12KB

MD5
2ca76a6543e1e644d5eec2a8620149d2

SHA1
42a03dfd435742c27da9997f71df44f7ab7d3c8d

SHA256
4ed7f61d00ca189aa15394ddbbee18afb8196509b23ce736646dbca8a84d9f37

SHA512
247d42a210e6c1d5185e96e94942871a76df598f8faf07ee59bd7c40349210a07fe492865d9dbefd27965828d2deed50af0dd6a17e30c93196a43dccc3a01761

Download Submit
C:\Users\Admin\AppData\Local\Temp\incl2
Filesize
23KB

MD5
c16384325859a47d6ce4e3e1fd4b43da

SHA1
7ba02c640a08688568e42dc2e5e7237562b077ea

SHA256
f6b3d2320e6e8666accf3637f100b70816275e354acfca56856b559544b02194

SHA512
70188378d5082d6427d5dc340ac5ca0c03ceef870b26b8f5a724ba17d14b4ba78c6483ae608da6c2e2d83d92ebc5068c37b206393888ef49f1cf34246a842deb

Download Submit
C:\Users\Admin\AppData\Local\Temp\incl2
Filesize
23KB

MD5
c16384325859a47d6ce4e3e1fd4b43da

SHA1
7ba02c640a08688568e42dc2e5e7237562b077ea

SHA256
f6b3d2320e6e8666accf3637f100b70816275e354acfca56856b559544b02194

SHA512
70188378d5082d6427d5dc340ac5ca0c03ceef870b26b8f5a724ba17d14b4ba78c6483ae608da6c2e2d83d92ebc5068c37b206393888ef49f1cf34246a842deb

Download Submit
C:\Users\Admin\AppData\Roaming\sample.exe
Filesize
873KB

MD5
592d7e07011a75a47ad84b4a0054222a

SHA1
a1e0f2ac27f6e9e749061b7070620c549b3769f2

SHA256
d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279

SHA512
cc8ae98b0fa0a46c10c71676007738ddd5867f6beb9ba0e748b7907a508b5f719014e4c4855f72ff5f15808f286daf17c5853134a432b5d4715f0502af5de0fc

Download Submit
C:\Users\Admin\AppData\Roaming\sample.exe
Filesize
873KB

MD5
592d7e07011a75a47ad84b4a0054222a

SHA1
a1e0f2ac27f6e9e749061b7070620c549b3769f2

SHA256
d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279

SHA512
cc8ae98b0fa0a46c10c71676007738ddd5867f6beb9ba0e748b7907a508b5f719014e4c4855f72ff5f15808f286daf17c5853134a432b5d4715f0502af5de0fc

Download Submit
C:\Users\Admin\AppData\Roaming\sample.exe
Filesize
873KB

MD5
592d7e07011a75a47ad84b4a0054222a

SHA1
a1e0f2ac27f6e9e749061b7070620c549b3769f2

SHA256
d7bb2d4aa5180fea7d4d83ead4c1b58e7ba57b02166b94c2581391a43b2ba279

SHA512
cc8ae98b0fa0a46c10c71676007738ddd5867f6beb9ba0e748b7907a508b5f719014e4c4855f72ff5f15808f286daf17c5853134a432b5d4715f0502af5de0fc

Download Submit
\??\pipe\LOCAL\crashpad_3828_XZVMGQZWNGRQKUYP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/720-170-0x0000000000000000-mapping.dmp

Download
memory/1060-153-0x0000000000000000-mapping.dmp

Download
memory/1084-185-0x0000000000000000-mapping.dmp

Download
memory/1104-148-0x0000000000000000-mapping.dmp

Download
memory/1104-149-0x0000000000830000-0x000000000083C000-memory.dmp

Filesize
48KB

Download
memory/1444-169-0x0000000000000000-mapping.dmp

Download
memory/1828-163-0x0000000000000000-mapping.dmp

Download
memory/1888-154-0x0000000000000000-mapping.dmp

Download
memory/2116-151-0x0000000000000000-mapping.dmp

Download
memory/2320-188-0x0000000000000000-mapping.dmp

Download
memory/2408-183-0x0000000000000000-mapping.dmp

Download
memory/2456-181-0x0000000000000000-mapping.dmp

Download
memory/2468-145-0x0000000000000000-mapping.dmp

Download
memory/2816-137-0x0000000000000000-mapping.dmp

Download
memory/3256-190-0x0000000000000000-mapping.dmp

Download
memory/3320-141-0x0000000000000000-mapping.dmp

Download
memory/3424-187-0x0000000000000000-mapping.dmp

Download
memory/3644-134-0x0000000000000000-mapping.dmp

Download
memory/3644-172-0x0000000000000000-mapping.dmp

Download
memory/3828-150-0x0000000000000000-mapping.dmp

Download
memory/3916-159-0x0000000000000000-mapping.dmp

Download
memory/4120-177-0x0000000000000000-mapping.dmp

Download
memory/4152-165-0x0000000000000000-mapping.dmp

Download
memory/4180-179-0x0000000000000000-mapping.dmp

Download
memory/4192-132-0x0000000000000000-mapping.dmp

Download
memory/4284-157-0x0000000000000000-mapping.dmp

Download
memory/4380-171-0x0000000000000000-mapping.dmp

Download
memory/4424-161-0x0000000000000000-mapping.dmp

Download
memory/4748-167-0x0000000000000000-mapping.dmp

Download
memory/4768-175-0x0000000000000000-mapping.dmp

Download
memory/4916-173-0x0000000000000000-mapping.dmp

Download