remcos | 015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d

Analysis

max time kernel
161s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2023, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe
Size

909KB
MD5

1471855e22fc3165fffc6e371bc01feb
SHA1

acd40870c767d6a4590b0ba5abe8cffad7651de5
SHA256

015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d
SHA512

419f8b0cc930569d92bc7eb8150bb6d6503d290ade994f04ca2b24dbeec3cf13d0bf506fe123e7b03dd933cbb85864ba93a1535982e8fdbbe2edc8f00c467973
SSDEEP

12288:OyQaMFM0Mvxv9pb4wWCr5RUggLg3pZgPBARN3qQ:Oyjv9Mwd7bcO4

Score

10^/10

remcos independence microsoft persistence phishing rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Independence

ascoitaliasasummer.duckdns.org:3030

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
Windows Sessions Start.exe
copy_folder
Microsoft Media Session
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%WinDir%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Windows Display
keylog_path
%WinDir%
mouse_option
false
mutex
Windows Audio
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
Windows Sounds EndPoints
take_screenshot_option
true
take_screenshot_time
5
take_screenshot_title
Username;password;proforma;invoice;notepad

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe

Executes dropped EXE 4 IoCs

pid	Process
3952	Windows Sessions Start.exe
4736	Windows Sessions Start.exe
3248	Windows Sessions Start.exe
3968	Windows Sessions Start.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Sounds EndPoints = "\"C:\\Windows\\Microsoft Media Session\\Windows Sessions Start.exe\""	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Sounds EndPoints = "\"C:\\Windows\\Microsoft Media Session\\Windows Sessions Start.exe\""	Windows Sessions Start.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Sounds EndPoints = "\"C:\\Windows\\Microsoft Media Session\\Windows Sessions Start.exe\""	Windows Sessions Start.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Sounds EndPoints = "\"C:\\Windows\\Microsoft Media Session\\Windows Sessions Start.exe\""	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3144 set thread context of 3388	3144	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe	90
PID 3952 set thread context of 3968	3952	Windows Sessions Start.exe	97
PID 3968 set thread context of 4696	3968	Windows Sessions Start.exe	98

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft Media Session\Windows Sessions Start.exe	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe
File opened for modification	C:\Windows\Microsoft Media Session\Windows Sessions Start.exe	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe
File opened for modification	C:\Windows\Microsoft Media Session	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2092	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3952	Windows Sessions Start.exe
3952	Windows Sessions Start.exe
3952	Windows Sessions Start.exe
3952	Windows Sessions Start.exe
3596	msedge.exe
3596	msedge.exe
2060	msedge.exe
2060	msedge.exe
4328	identity_helper.exe
4328	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3952	Windows Sessions Start.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 3388	3144	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe	90
PID 3144 wrote to memory of 3388	3144	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe	90
PID 3144 wrote to memory of 3388	3144	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe	90
PID 3144 wrote to memory of 3388	3144	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe	90
PID 3144 wrote to memory of 3388	3144	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe	90
PID 3144 wrote to memory of 3388	3144	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe	90
PID 3144 wrote to memory of 3388	3144	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe	90
PID 3144 wrote to memory of 3388	3144	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe	90
PID 3144 wrote to memory of 3388	3144	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe	90
PID 3388 wrote to memory of 3692	3388	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe	91
PID 3388 wrote to memory of 3692	3388	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe	91
PID 3388 wrote to memory of 3692	3388	NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe	91
PID 3692 wrote to memory of 2092	3692	cmd.exe	93
PID 3692 wrote to memory of 2092	3692	cmd.exe	93
PID 3692 wrote to memory of 2092	3692	cmd.exe	93
PID 3692 wrote to memory of 3952	3692	cmd.exe	94
PID 3692 wrote to memory of 3952	3692	cmd.exe	94
PID 3692 wrote to memory of 3952	3692	cmd.exe	94
PID 3952 wrote to memory of 4736	3952	Windows Sessions Start.exe	95
PID 3952 wrote to memory of 4736	3952	Windows Sessions Start.exe	95
PID 3952 wrote to memory of 4736	3952	Windows Sessions Start.exe	95
PID 3952 wrote to memory of 3248	3952	Windows Sessions Start.exe	96
PID 3952 wrote to memory of 3248	3952	Windows Sessions Start.exe	96
PID 3952 wrote to memory of 3248	3952	Windows Sessions Start.exe	96
PID 3952 wrote to memory of 3968	3952	Windows Sessions Start.exe	97
PID 3952 wrote to memory of 3968	3952	Windows Sessions Start.exe	97
PID 3952 wrote to memory of 3968	3952	Windows Sessions Start.exe	97
PID 3952 wrote to memory of 3968	3952	Windows Sessions Start.exe	97
PID 3952 wrote to memory of 3968	3952	Windows Sessions Start.exe	97
PID 3952 wrote to memory of 3968	3952	Windows Sessions Start.exe	97
PID 3952 wrote to memory of 3968	3952	Windows Sessions Start.exe	97
PID 3952 wrote to memory of 3968	3952	Windows Sessions Start.exe	97
PID 3952 wrote to memory of 3968	3952	Windows Sessions Start.exe	97
PID 3968 wrote to memory of 4696	3968	Windows Sessions Start.exe	98
PID 3968 wrote to memory of 4696	3968	Windows Sessions Start.exe	98
PID 3968 wrote to memory of 4696	3968	Windows Sessions Start.exe	98
PID 3968 wrote to memory of 4696	3968	Windows Sessions Start.exe	98
PID 3968 wrote to memory of 4696	3968	Windows Sessions Start.exe	98
PID 3968 wrote to memory of 4696	3968	Windows Sessions Start.exe	98
PID 3968 wrote to memory of 4696	3968	Windows Sessions Start.exe	98
PID 3968 wrote to memory of 4696	3968	Windows Sessions Start.exe	98
PID 4696 wrote to memory of 2060	4696	iexplore.exe	99
PID 4696 wrote to memory of 2060	4696	iexplore.exe	99
PID 2060 wrote to memory of 4020	2060	msedge.exe	100
PID 2060 wrote to memory of 4020	2060	msedge.exe	100
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101
PID 2060 wrote to memory of 3628	2060	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747dexeexe_JC.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3692
  - - C:\Windows\SysWOW64\PING.EXE
      PING 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:2092
  - - C:\Windows\Microsoft Media Session\Windows Sessions Start.exe
      "C:\Windows\Microsoft Media Session\Windows Sessions Start.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3952
    - - C:\Windows\Microsoft Media Session\Windows Sessions Start.exe
        
        "C:\Windows\Microsoft Media Session\Windows Sessions Start.exe"
        5⤵
        Executes dropped EXE
        
        PID:4736
    - - C:\Windows\Microsoft Media Session\Windows Sessions Start.exe
        
        "C:\Windows\Microsoft Media Session\Windows Sessions Start.exe"
        5⤵
        Executes dropped EXE
        
        PID:3248
    - - C:\Windows\Microsoft Media Session\Windows Sessions Start.exe
        
        "C:\Windows\Microsoft Media Session\Windows Sessions Start.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3968
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        7⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd298046f8,0x7ffd29804708,0x7ffd29804718
        8⤵
        
        PID:4020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,7327612171745790715,16767679427821749102,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
        8⤵
        
        PID:3628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,7327612171745790715,16767679427821749102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,7327612171745790715,16767679427821749102,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
        8⤵
        
        PID:4332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7327612171745790715,16767679427821749102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
        8⤵
        
        PID:4984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7327612171745790715,16767679427821749102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
        8⤵
        
        PID:4592
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7327612171745790715,16767679427821749102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
        8⤵
        
        PID:820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,7327612171745790715,16767679427821749102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
        8⤵
        
        PID:1388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,7327612171745790715,16767679427821749102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7327612171745790715,16767679427821749102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
        8⤵
        
        PID:2668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7327612171745790715,16767679427821749102,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
        8⤵
        
        PID:548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7327612171745790715,16767679427821749102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
        8⤵
        
        PID:4176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7327612171745790715,16767679427821749102,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
        8⤵
        
        PID:1736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7327612171745790715,16767679427821749102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
        8⤵
        
        PID:5020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7327612171745790715,16767679427821749102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
        8⤵
        
        PID:4252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        7⤵
        
        PID:3448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd298046f8,0x7ffd29804708,0x7ffd29804718
        8⤵
        
        PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6dded92ec95cf9f22410bdeac841a00d

SHA1
83c32c23d53c59d654868f0b2a5c6be0a46249c2

SHA256
1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e

SHA512
e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6dded92ec95cf9f22410bdeac841a00d

SHA1
83c32c23d53c59d654868f0b2a5c6be0a46249c2

SHA256
1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e

SHA512
e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
527eacccf930aed3bbce942c40806a7b

SHA1
d9a9f3da27ea1acaf1d5cf93c5e20232a96f7be3

SHA256
3a3e3874da86a9a533eb418e76ca152b6aa38a33cefa0d4920ffbc31aa1ea09e

SHA512
a9e836a44569e0684649bf8537565ec7a1cb1631fb4abdf0da17be164d39d866dd675e25bb658c1b0dfe6338228f73d78566adc17fa3c1396991cee67160cee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3bdbf80a5d872c5cce8182731a67e0a4

SHA1
c976a24b04e37082d95cc1cdbdf7a514c4a5030b

SHA256
a122fcc5cf7c396bb02f7614dc92e112aea4ee30875eddb2b784f2d214b92174

SHA512
dfcdd1525c597c4b1db92b8c0e5be378803d58697327a54e677d96fcc6b5f0058c382e5f857cf8b7f809d053e51902cd88069f75f4350485ea6bef5cd407b584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ed7c5382dd9979ade45c1a256bf8e5db

SHA1
0202e6003e0ec572a0d37c05d66897d6d6581aa1

SHA256
5b88feb121333636554143ab2c614f2a4af611de6f4d44b08bebf1773d216dc1

SHA512
a48888b22c2524271af54b8bb96a7ec7e5bbfe3f9c97a904dc8fd64b582de67338fac552be1ef43a4f33f886cc0b895c799b4167a472f38c10f67bc7c82caa49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
58c928580e858ad589c8b8be5cff8fe4

SHA1
7120c62014a81076c80d24aefc67153329af1c6e

SHA256
a3011ea69ff6cd2ed1de1459dbc2670e9e92a1c1b471980fe48ec878d15503a2

SHA512
9f8ad4d019d57b7318afc0a3f644287573eab7688686e2b20a2ca7ed050692fbd1d8ae5b79cf90883cffe1e217dcf41d5fa2e366c8fa70c454334325f8b7a12b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e05436aebb117e9919978ca32bbcefd9

SHA1
97b2af055317952ce42308ea69b82301320eb962

SHA256
cc9bd0953e70356e31a957ad9a9b1926f5e2a9f6a297cdef303ac693a2a86b7f

SHA512
11328e9514ffaa3c1eab84fae06595d75c8503bd5601adfd806182d46065752885a871b738439b356d1bb2c1ac71fc81e9d46bd2d0daa1b2ba0f40543bf952b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
e057214e1e66da264293bd3c62c2bbd4

SHA1
9ea2ca6e14e7d31dddc63ee14a26ba1bdc5aefde

SHA256
1f13e7ccee8e8faf359f07c53f898db2c029f442a20ba1c98144267594d8b972

SHA512
681da8581f19597a13373599fd549e14495f7e21f769dfa2fd2184f786a4c54ffcb10401f82c16cef14e0286581eb58339f8b3794a5583c769b001e2b27cd015

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59a57d.TMP

Filesize
371B

MD5
a353bd2c57404bfe72f2fc60bc85509c

SHA1
d1e4f085e725c0d0dfe9bf1faa58b1429f75bbda

SHA256
ef442854414491274925c44b722f90cd72fbea3d6239210542d3b13a6be2dcb2

SHA512
2960866b562f0dffcfb2a2fb80b20b7b59f30607e7dac8c3cc89e83b48bc38d149887eaa96c5f37df8857cfd2093681d0cc4e622518733f59061fcb4c111efe9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d02e6a2a50c9b0a7996c9d09c6a097b4

SHA1
b9f148963a30b06e9f18cf79ab270a0403f27b2b

SHA256
f8119eb86add39ece1430a79ff4a35f45565fd5b4508c56658fe1cc3389a31a4

SHA512
fe0488739e99b80fe5e66719ec08afcd411bc260a936bc4f6805070ce723ae4205667ffddb0bee3adb9db0175ea0b3f20d9a405c2560a4eb35c69bda958fa6e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
98311354aafe5ee9b39851e0135898cb

SHA1
584990b7eedf48041edf31daae0e088cd34690a0

SHA256
26d8be4b49def32ef10f474e4231b6af3c8c34664cb2b2e2a485d690ae4603de

SHA512
ad4bf81914aa6ee80cd0870cd6186adce616b0967a0e8e498470b7b2efe81f2aec1f41cd3bcc0e15a60781804a53eb9c51902c13e4d0d9bdc14f09b3e777b4d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.bat

Filesize
112B

MD5
40a998ff79f4402d4f33fea33d691229

SHA1
16719c08bf1008db7ae4cc7dcc32bc8a5c231102

SHA256
c301c55862e8ec3d976b511dafd63f73cde752d8a3fd67a1c893f2c072fb06b5

SHA512
d1d6ce31648d560007127f694df0ae18edc93d4a2bc12ff50771d6d21023c8a2f80acef95e27bb97be3f0cac986f7945adfcf68b15287022464b0d1092c99b98

Download Submit
C:\Windows\Microsoft Media Session\Windows Sessions Start.exe

Filesize
909KB

MD5
1471855e22fc3165fffc6e371bc01feb

SHA1
acd40870c767d6a4590b0ba5abe8cffad7651de5

SHA256
015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d

SHA512
419f8b0cc930569d92bc7eb8150bb6d6503d290ade994f04ca2b24dbeec3cf13d0bf506fe123e7b03dd933cbb85864ba93a1535982e8fdbbe2edc8f00c467973

Download Submit
C:\Windows\Microsoft Media Session\Windows Sessions Start.exe

Filesize
909KB

MD5
1471855e22fc3165fffc6e371bc01feb

SHA1
acd40870c767d6a4590b0ba5abe8cffad7651de5

SHA256
015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d

SHA512
419f8b0cc930569d92bc7eb8150bb6d6503d290ade994f04ca2b24dbeec3cf13d0bf506fe123e7b03dd933cbb85864ba93a1535982e8fdbbe2edc8f00c467973

Download Submit
C:\Windows\Microsoft Media Session\Windows Sessions Start.exe

Filesize
909KB

MD5
1471855e22fc3165fffc6e371bc01feb

SHA1
acd40870c767d6a4590b0ba5abe8cffad7651de5

SHA256
015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d

SHA512
419f8b0cc930569d92bc7eb8150bb6d6503d290ade994f04ca2b24dbeec3cf13d0bf506fe123e7b03dd933cbb85864ba93a1535982e8fdbbe2edc8f00c467973

Download Submit
C:\Windows\Microsoft Media Session\Windows Sessions Start.exe

Filesize
909KB

MD5
1471855e22fc3165fffc6e371bc01feb

SHA1
acd40870c767d6a4590b0ba5abe8cffad7651de5

SHA256
015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d

SHA512
419f8b0cc930569d92bc7eb8150bb6d6503d290ade994f04ca2b24dbeec3cf13d0bf506fe123e7b03dd933cbb85864ba93a1535982e8fdbbe2edc8f00c467973

Download Submit
C:\Windows\Microsoft Media Session\Windows Sessions Start.exe

Filesize
909KB

MD5
1471855e22fc3165fffc6e371bc01feb

SHA1
acd40870c767d6a4590b0ba5abe8cffad7651de5

SHA256
015de283d33b7b246204fad78eaede87ab7939aaa34f035d59569aec3606747d

SHA512
419f8b0cc930569d92bc7eb8150bb6d6503d290ade994f04ca2b24dbeec3cf13d0bf506fe123e7b03dd933cbb85864ba93a1535982e8fdbbe2edc8f00c467973

Download Submit
memory/3144-11-0x0000000006AE0000-0x0000000006B3A000-memory.dmp

Filesize
360KB

Download
memory/3144-7-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/3144-1-0x00000000004F0000-0x00000000005DA000-memory.dmp

Filesize
936KB

Download
memory/3144-2-0x0000000005620000-0x0000000005BC4000-memory.dmp

Filesize
5.6MB

Download
memory/3144-3-0x0000000004FB0000-0x0000000005042000-memory.dmp

Filesize
584KB

Download
memory/3144-4-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/3144-5-0x0000000005080000-0x000000000508A000-memory.dmp

Filesize
40KB

Download
memory/3144-17-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/3144-6-0x0000000005170000-0x000000000518E000-memory.dmp

Filesize
120KB

Download
memory/3144-8-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/3144-9-0x00000000065D0000-0x00000000065DC000-memory.dmp

Filesize
48KB

Download
memory/3144-10-0x00000000065E0000-0x00000000065F0000-memory.dmp

Filesize
64KB

Download
memory/3144-0-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/3144-12-0x0000000009130000-0x00000000091CC000-memory.dmp

Filesize
624KB

Download
memory/3388-13-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3388-16-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3388-18-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3388-24-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3952-40-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download
memory/3952-29-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download
memory/3952-32-0x0000000005950000-0x0000000005960000-memory.dmp

Filesize
64KB

Download
memory/3952-31-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download
memory/3952-30-0x0000000005950000-0x0000000005960000-memory.dmp

Filesize
64KB

Download
memory/3968-43-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3968-41-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3968-39-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download