metasploit | c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
Size

1.8MB
MD5

b63d033a7af7588d7c5ba60068d81e48
SHA1

0b8fba25bdee3f5f4e8c008f1bdeeae39e7128f1
SHA256

c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339
SHA512

895b4b199c8155d50b8b2830c9b266ef3a9f9a8e43c44c65b3897a78a14616f0cb925c33f714cfcffbb3fcde7888296273d65fca1ee4ec9b496a34c233a142a7
SSDEEP

24576:/3vLRdVhZBK8NogWYO09WOGi9J3YiWdCMJ5QxmjwC/hR:/3d5ZQ1+xJIiW0MbQxA

Score

10^/10

metasploit backdoor discovery spyware stealer trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

1.15.12.73:4567

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\J:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\K:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\V:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\A:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\B:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\I:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\M:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\N:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\O:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\S:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\Z:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\G:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\H:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\Q:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\T:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\W:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\X:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\Y:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\L:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\P:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\R:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
File opened (read-only)	\??\U:	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
3464	msedge.exe
3464	msedge.exe
3868	identity_helper.exe
3868	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	556	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
Token: SeDebugPrivilege	556	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
Token: SeDebugPrivilege	3256	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
Token: SeDebugPrivilege	3256	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 3256	556	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe	87
PID 556 wrote to memory of 3256	556	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe	87
PID 556 wrote to memory of 3256	556	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe	87
PID 3256 wrote to memory of 3464	3256	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe	95
PID 3256 wrote to memory of 3464	3256	c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe	95
PID 3464 wrote to memory of 3976	3464	msedge.exe	96
PID 3464 wrote to memory of 3976	3464	msedge.exe	96
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 3076	3464	msedge.exe	98
PID 3464 wrote to memory of 4392	3464	msedge.exe	99
PID 3464 wrote to memory of 4392	3464	msedge.exe	99
PID 3464 wrote to memory of 1608	3464	msedge.exe	100
PID 3464 wrote to memory of 1608	3464	msedge.exe	100
PID 3464 wrote to memory of 1608	3464	msedge.exe	100
PID 3464 wrote to memory of 1608	3464	msedge.exe	100
PID 3464 wrote to memory of 1608	3464	msedge.exe	100
PID 3464 wrote to memory of 1608	3464	msedge.exe	100
PID 3464 wrote to memory of 1608	3464	msedge.exe	100
PID 3464 wrote to memory of 1608	3464	msedge.exe	100
PID 3464 wrote to memory of 1608	3464	msedge.exe	100
PID 3464 wrote to memory of 1608	3464	msedge.exe	100
PID 3464 wrote to memory of 1608	3464	msedge.exe	100
PID 3464 wrote to memory of 1608	3464	msedge.exe	100
PID 3464 wrote to memory of 1608	3464	msedge.exe	100
PID 3464 wrote to memory of 1608	3464	msedge.exe	100
PID 3464 wrote to memory of 1608	3464	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
"C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556
- C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
  "C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe" Admin
  2⤵
  - Drops file in Drivers directory
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb95546f8,0x7ffeb9554708,0x7ffeb9554718
      4⤵
      PID:3976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
      4⤵
      PID:3076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3008 /prefetch:8
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:4028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
      4⤵
      PID:2188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
      4⤵
      PID:724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
      4⤵
      PID:1620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
      4⤵
      PID:1584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fa070c9c9ab8d902ee4f3342d217275f

SHA1
ac69818312a7eba53586295c5b04eefeb5c73903

SHA256
245b396ed1accfae337f770d3757c932bc30a8fc8dd133b5cefe82242760c2c7

SHA512
df92ca6d405d603ef5f07dbf9516d9e11e1fdc13610bb59e6d4712e55dd661f756c8515fc2c359c1db6b8b126e7f5a15886e643d93c012ef34a11041e02cc0dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3802a059fc41279ad6b0876423304512

SHA1
5c9b88c9dd84741ab933ce84d6b7822474b45b8f

SHA256
89d554d4e88e1e2939872bedb9ea1a0ffb02adea086d4b26abd11d1241ab87f8

SHA512
e00ae1e7d7816d3cb9b7d21f537cb3ae56e6af8990e8eacfc198d0075f46988aa010669dab573846929bf21a479b0bbcbe48ef97feaebebe2ff6e06e5f5f6fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
056352c8efa4bae213728ccea238fba2

SHA1
fb3f56265d04be8c1f7c81e85d9767832fde7f49

SHA256
82d4d361590932b81049e11f374c407f0eaaa57f1cda936beaf2d27b37504c4d

SHA512
3a36d6086ff3784ebe711bb2636b2d60450c9f5782b178c141aba2c92ee26729ff3c7b92a368f2a29bebfa55a979ea2611a762a8ed0aad125e9e04e4126c9581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
917dedf44ae3675e549e7b7ffc2c8ccd

SHA1
b7604eb16f0366e698943afbcf0c070d197271c0

SHA256
9692162e8a88be0977395cc0704fe882b9a39b78bdfc9d579a8c961e15347a37

SHA512
9628f7857eb88f8dceac00ffdcba2ed822fb9ebdada95e54224a0afc50bccd3e3d20c5abadbd20f61eba51dbf71c5c745b29309122d88b5cc6752a1dfc3be053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
17c5f1cc92f3d32918dcc2180f436f7d

SHA1
4617d51e696f0cbe32d7a599cabcab96d000139a

SHA256
701e15f755492dc9be4501829db20c69510ce8140389fdabee44958c98d79731

SHA512
a0452c670a52b9d4b0ff4560b1989c430beea0880347b4f0cfa65d864e16513f84d6d9e9aa91f9bba604d07de396582f44e513e8bab2fad5cc12d7602fd99e8a

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
822B

MD5
03450e8ddb20859f242195450c19b8f1

SHA1
9698f8caf67c8853e14c8bf4933949f458c3044a

SHA256
1bdd8f1dd7bd82b5b2313d8770dfe4f41cd3f45bbaeab8b8a7f75fc5e2d3720b

SHA512
87371e57bf2296af5ec7f5db772a4ce66729d54aa23a8b384e3f4c42310b97b636576c7dff67c27a3b679339cdeee05b836563ae2a878f0367caf247b3e1ba7b

Download Submit
memory/556-0-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/556-4-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/556-2-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/556-1-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/3256-6-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/3256-14-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/3256-12-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/3256-11-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/3256-10-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/3256-9-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download