Analysis
-
max time kernel
1s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
04-01-2024 02:01
Static task
static1
Behavioral task
behavioral1
Sample
124d756a655a6c4338f61ec8f43551dce23078e04d51ca4c03ca34f5df66af27.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
124d756a655a6c4338f61ec8f43551dce23078e04d51ca4c03ca34f5df66af27.exe
Resource
win10v2004-20231222-en
General
-
Target
124d756a655a6c4338f61ec8f43551dce23078e04d51ca4c03ca34f5df66af27.exe
-
Size
2.5MB
-
MD5
e4a94d95c0af5a7082f90904e577ab04
-
SHA1
b2c6961b3f7e3c5fe0fe86743a3360633ab2c200
-
SHA256
124d756a655a6c4338f61ec8f43551dce23078e04d51ca4c03ca34f5df66af27
-
SHA512
3158b5f2e80e2bf1312e88cf43e1754068f0a28f620cbf09e1945e820796aadc39bf0dca04ea7d150aa167aa1bd08945980d6cc5602ac6593e9fd08ec6b9c44d
-
SSDEEP
49152:hAcs6KxDps2x208AjgcbniYA5Ml2CgUBe+82POGAPmtnDguqFfzBk:OdtstrAjgcbiYx2rAZWJ4Uuq9+
Malware Config
Extracted
redline
777
195.20.16.103:20440
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1400-1013-0x0000000000400000-0x0000000000452000-memory.dmp family_redline -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Executes dropped EXE 3 IoCs
Processes:
oI7UZ69.exeNP7ET53.exe2KA3418.exepid process 4872 oI7UZ69.exe 1828 NP7ET53.exe 668 2KA3418.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
NP7ET53.exe124d756a655a6c4338f61ec8f43551dce23078e04d51ca4c03ca34f5df66af27.exeoI7UZ69.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" NP7ET53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 124d756a655a6c4338f61ec8f43551dce23078e04d51ca4c03ca34f5df66af27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" oI7UZ69.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4508 5084 WerFault.exe 5al0xM9.exe 5348 2320 WerFault.exe 6Qm8xN5.exe 4808 3316 WerFault.exe toolspub2.exe 5088 2640 WerFault.exe FCE9.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 5992 schtasks.exe 5556 schtasks.exe -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
2KA3418.exepid process 668 2KA3418.exe 668 2KA3418.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
2KA3418.exepid process 668 2KA3418.exe 668 2KA3418.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
124d756a655a6c4338f61ec8f43551dce23078e04d51ca4c03ca34f5df66af27.exeoI7UZ69.exeNP7ET53.exedescription pid process target process PID 3516 wrote to memory of 4872 3516 124d756a655a6c4338f61ec8f43551dce23078e04d51ca4c03ca34f5df66af27.exe oI7UZ69.exe PID 3516 wrote to memory of 4872 3516 124d756a655a6c4338f61ec8f43551dce23078e04d51ca4c03ca34f5df66af27.exe oI7UZ69.exe PID 3516 wrote to memory of 4872 3516 124d756a655a6c4338f61ec8f43551dce23078e04d51ca4c03ca34f5df66af27.exe oI7UZ69.exe PID 4872 wrote to memory of 1828 4872 oI7UZ69.exe NP7ET53.exe PID 4872 wrote to memory of 1828 4872 oI7UZ69.exe NP7ET53.exe PID 4872 wrote to memory of 1828 4872 oI7UZ69.exe NP7ET53.exe PID 1828 wrote to memory of 668 1828 NP7ET53.exe 2KA3418.exe PID 1828 wrote to memory of 668 1828 NP7ET53.exe 2KA3418.exe PID 1828 wrote to memory of 668 1828 NP7ET53.exe 2KA3418.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\124d756a655a6c4338f61ec8f43551dce23078e04d51ca4c03ca34f5df66af27.exe"C:\Users\Admin\AppData\Local\Temp\124d756a655a6c4338f61ec8f43551dce23078e04d51ca4c03ca34f5df66af27.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oI7UZ69.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oI7UZ69.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NP7ET53.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NP7ET53.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2KA3418.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2KA3418.exe4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcf91546f8,0x7ffcf9154708,0x7ffcf91547186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,14283589331990762354,11869016276136908780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:36⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,14283589331990762354,11869016276136908780,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://facebook.com/login5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,10398192597734854215,6611302017675563632,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1956 /prefetch:26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,10398192597734854215,6611302017675563632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,10398192597734854215,6611302017675563632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,10398192597734854215,6611302017675563632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,10398192597734854215,6611302017675563632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,10398192597734854215,6611302017675563632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1952,10398192597734854215,6611302017675563632,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:86⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,10398192597734854215,6611302017675563632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 /prefetch:36⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1952,10398192597734854215,6611302017675563632,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5552 /prefetch:86⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1952,10398192597734854215,6611302017675563632,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5752 /prefetch:86⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,10398192597734854215,6611302017675563632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:86⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,10398192597734854215,6611302017675563632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:86⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,10398192597734854215,6611302017675563632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,10398192597734854215,6611302017675563632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,10398192597734854215,6611302017675563632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,10398192597734854215,6611302017675563632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,10398192597734854215,6611302017675563632,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3036 /prefetch:26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5al0xM9.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5al0xM9.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose5⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 30685⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Qm8xN5.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Qm8xN5.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 8644⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7SO0vB82.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7SO0vB82.exe2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcf91546f8,0x7ffcf9154708,0x7ffcf91547181⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x178,0x17c,0x180,0x154,0x184,0x7ffcf91546f8,0x7ffcf9154708,0x7ffcf91547181⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,14720159247623038320,2225613904404485265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:31⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,14720159247623038320,2225613904404485265,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:21⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2c8 0x1501⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5084 -ip 50841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2320 -ip 23201⤵
-
C:\Users\Admin\AppData\Local\Temp\FCE9.exeC:\Users\Admin\AppData\Local\Temp\FCE9.exe1⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 7082⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\36C7.exeC:\Users\Admin\AppData\Local\Temp\36C7.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Users\Admin\AppData\Local\Temp\tuc4.exe"C:\Users\Admin\AppData\Local\Temp\tuc4.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-I568P.tmp\tuc4.tmp"C:\Users\Admin\AppData\Local\Temp\is-I568P.tmp\tuc4.tmp" /SL5="$601F6,7884275,54272,C:\Users\Admin\AppData\Local\Temp\tuc4.exe"3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 234⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 235⤵
-
C:\Program Files (x86)\DataPumpCRT\datapumpcrt.exe"C:\Program Files (x86)\DataPumpCRT\datapumpcrt.exe" -i4⤵
-
C:\Program Files (x86)\DataPumpCRT\datapumpcrt.exe"C:\Program Files (x86)\DataPumpCRT\datapumpcrt.exe" -s4⤵
-
C:\Users\Admin\AppData\Local\Temp\etopt.exe"C:\Users\Admin\AppData\Local\Temp\etopt.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\nsq4501.tmp.exeC:\Users\Admin\AppData\Local\Temp\nsq4501.tmp.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 3282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3316 -ip 33161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2640 -ip 26401⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes1⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
2KB
MD5345326b0cfba20d8835398b35e42f708
SHA13f284ed5af152fe4b1750a1932b4701ed758188a
SHA25645d334dfca621d9f588453028a810c79992ed02d5a066f64a49cd8ea8f1a1961
SHA5128c7d953a554407a81c0ae4313a0ec71a959b41cefdeebb883764c5afc74932306de201cf58fd6da90b4e51d426c6939d39c53d3b5ef0e184b0f58fba03753f42
-
memory/376-728-0x0000000000C50000-0x0000000000C51000-memory.dmpFilesize
4KB
-
memory/376-966-0x0000000000400000-0x0000000000965000-memory.dmpFilesize
5.4MB
-
memory/1300-969-0x0000000000400000-0x00000000004BC000-memory.dmpFilesize
752KB
-
memory/1300-792-0x0000000000610000-0x0000000000611000-memory.dmpFilesize
4KB
-
memory/1400-1013-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1540-613-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1540-620-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1580-889-0x0000000003080000-0x00000000030BA000-memory.dmpFilesize
232KB
-
memory/1580-825-0x00000000042F0000-0x0000000004F18000-memory.dmpFilesize
12.2MB
-
memory/1580-787-0x0000000003040000-0x0000000003041000-memory.dmpFilesize
4KB
-
memory/1580-762-0x0000000010000000-0x000000001001B000-memory.dmpFilesize
108KB
-
memory/2052-750-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/2052-682-0x0000000000E70000-0x000000000214E000-memory.dmpFilesize
18.9MB
-
memory/2052-679-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/2320-579-0x00000000024F0000-0x000000000256C000-memory.dmpFilesize
496KB
-
memory/2320-608-0x0000000000400000-0x0000000000892000-memory.dmpFilesize
4.6MB
-
memory/2320-609-0x00000000024F0000-0x000000000256C000-memory.dmpFilesize
496KB
-
memory/2320-578-0x0000000000A30000-0x0000000000B30000-memory.dmpFilesize
1024KB
-
memory/2320-580-0x0000000000400000-0x0000000000892000-memory.dmpFilesize
4.6MB
-
memory/2504-741-0x0000000000460000-0x0000000000469000-memory.dmpFilesize
36KB
-
memory/2504-735-0x0000000000480000-0x0000000000580000-memory.dmpFilesize
1024KB
-
memory/2640-674-0x0000000005060000-0x00000000050FC000-memory.dmpFilesize
624KB
-
memory/2640-749-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/2640-673-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/2640-672-0x0000000000390000-0x0000000000756000-memory.dmpFilesize
3.8MB
-
memory/3316-751-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3316-941-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3316-744-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3492-933-0x00000000006B0000-0x00000000006C6000-memory.dmpFilesize
88KB
-
memory/3492-619-0x00000000001C0000-0x00000000001D6000-memory.dmpFilesize
88KB
-
memory/3580-786-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3580-764-0x0000000002EC0000-0x00000000037AB000-memory.dmpFilesize
8.9MB
-
memory/3580-752-0x0000000002AC0000-0x0000000002EBD000-memory.dmpFilesize
4.0MB
-
memory/3580-967-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3732-733-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3732-968-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4024-958-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/4024-960-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/4576-922-0x0000000005C60000-0x0000000005FB4000-memory.dmpFilesize
3.3MB
-
memory/4576-932-0x0000000006300000-0x000000000634C000-memory.dmpFilesize
304KB
-
memory/4576-920-0x0000000002860000-0x0000000002870000-memory.dmpFilesize
64KB
-
memory/4576-921-0x0000000002860000-0x0000000002870000-memory.dmpFilesize
64KB
-
memory/4576-919-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/4576-943-0x000000007F120000-0x000000007F130000-memory.dmpFilesize
64KB
-
memory/4576-945-0x0000000072070000-0x00000000723C4000-memory.dmpFilesize
3.3MB
-
memory/4576-956-0x0000000007820000-0x00000000078C3000-memory.dmpFilesize
652KB
-
memory/4576-944-0x0000000071D00000-0x0000000071D4C000-memory.dmpFilesize
304KB
-
memory/4576-940-0x00000000071C0000-0x0000000007204000-memory.dmpFilesize
272KB
-
memory/4848-1095-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/5084-95-0x0000000008970000-0x00000000089E6000-memory.dmpFilesize
472KB
-
memory/5084-367-0x0000000000470000-0x00000000008CE000-memory.dmpFilesize
4.4MB
-
memory/5084-564-0x0000000000470000-0x00000000008CE000-memory.dmpFilesize
4.4MB
-
memory/5084-39-0x0000000000470000-0x00000000008CE000-memory.dmpFilesize
4.4MB
-
memory/5084-551-0x0000000000470000-0x00000000008CE000-memory.dmpFilesize
4.4MB
-
memory/5084-58-0x0000000000470000-0x00000000008CE000-memory.dmpFilesize
4.4MB
-
memory/5084-476-0x000000000A8C0000-0x000000000AC14000-memory.dmpFilesize
3.3MB
-
memory/5084-461-0x00000000098B0000-0x00000000098CE000-memory.dmpFilesize
120KB
-
memory/5608-216-0x00000000071A0000-0x00000000071AA000-memory.dmpFilesize
40KB
-
memory/5608-347-0x0000000007450000-0x0000000007458000-memory.dmpFilesize
32KB
-
memory/5608-104-0x0000000004FE0000-0x0000000005608000-memory.dmpFilesize
6.2MB
-
memory/5608-135-0x0000000005740000-0x00000000057A6000-memory.dmpFilesize
408KB
-
memory/5608-105-0x0000000073BF0000-0x00000000743A0000-memory.dmpFilesize
7.7MB
-
memory/5608-108-0x00000000049A0000-0x00000000049B0000-memory.dmpFilesize
64KB
-
memory/5608-140-0x00000000056C0000-0x0000000005726000-memory.dmpFilesize
408KB
-
memory/5608-143-0x00000000058E0000-0x0000000005C34000-memory.dmpFilesize
3.3MB
-
memory/5608-196-0x00000000049A0000-0x00000000049B0000-memory.dmpFilesize
64KB
-
memory/5608-220-0x00000000073B0000-0x0000000007446000-memory.dmpFilesize
600KB
-
memory/5608-144-0x0000000005DE0000-0x0000000005DFE000-memory.dmpFilesize
120KB
-
memory/5608-352-0x0000000073BF0000-0x00000000743A0000-memory.dmpFilesize
7.7MB
-
memory/5608-204-0x0000000007770000-0x0000000007DEA000-memory.dmpFilesize
6.5MB
-
memory/5608-122-0x0000000005680000-0x00000000056A2000-memory.dmpFilesize
136KB
-
memory/5608-147-0x0000000005E10000-0x0000000005E5C000-memory.dmpFilesize
304KB
-
memory/5608-183-0x000000007EF80000-0x000000007EF90000-memory.dmpFilesize
64KB
-
memory/5608-184-0x0000000006FB0000-0x0000000006FE2000-memory.dmpFilesize
200KB
-
memory/5608-205-0x0000000007130000-0x000000000714A000-memory.dmpFilesize
104KB
-
memory/5608-346-0x0000000007470000-0x000000000748A000-memory.dmpFilesize
104KB
-
memory/5608-345-0x0000000007370000-0x0000000007384000-memory.dmpFilesize
80KB
-
memory/5608-106-0x00000000049A0000-0x00000000049B0000-memory.dmpFilesize
64KB
-
memory/5608-103-0x0000000004870000-0x00000000048A6000-memory.dmpFilesize
216KB
-
memory/5608-343-0x0000000007360000-0x000000000736E000-memory.dmpFilesize
56KB
-
memory/5608-234-0x0000000007330000-0x0000000007341000-memory.dmpFilesize
68KB
-
memory/5608-185-0x0000000070280000-0x00000000702CC000-memory.dmpFilesize
304KB
-
memory/5608-195-0x00000000063C0000-0x00000000063DE000-memory.dmpFilesize
120KB
-
memory/5608-197-0x0000000006FF0000-0x0000000007093000-memory.dmpFilesize
652KB