kinsing | cd795efaecacad8749827588ac045d9d209a0eb29656a0c5cc903f1ad49231d7

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Заказ на покупку_(P.O_6203445-2024)_Викторович ООО.exe
Size

657KB
MD5

0e791ce3c5922bb2cd95f33b59296db3
SHA1

b2f53b32ccef839718bbd47b560daeb7e8aa541c
SHA256

0c82feaf206d2633de0904b7fe4f34da47e4dcf08079afd668101c180e2df32d
SHA512

011c5e502bc3a90f9672411b81c44967401d91365f0951e22c2a4621e27f702696c528d5da4c1484d579b9b6cd22b2d3441d6989d96103e4c2b0599c9dfdcaf2
SSDEEP

12288:uqUyZzjn9co0d0wvvSQNCY62XACRCY27D8:xdZKo02cvS4CY6iAqCY27Y

Score

10^/10

kinsing lokibot collection loader spyware stealer trojan

Malware Config

Extracted

Family

lokibot

https://novlkyy.shop/PWS/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Заказ на покупку_(P.O_6203445-2024)_Викторович ООО.exePO.exeW.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	Заказ на покупку_(P.O_6203445-2024)_Викторович ООО.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	PO.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	W.exe

Executes dropped EXE 3 IoCs

Processes:

PO.exeW.exeWG.exe

pid process

5028 PO.exe
4944 W.exe
3872 WG.exe

pid	process
5028	PO.exe
4944	W.exe
3872	WG.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

aspnet_compiler.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

WG.exe

description pid process target process

PID 3872 set thread context of 1552 3872 WG.exe aspnet_compiler.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 3872 set thread context of 1552	3872	WG.exe	aspnet_compiler.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
5032	msedge.exe
5032	msedge.exe
1392	msedge.exe
1392	msedge.exe
1476	identity_helper.exe
1476	identity_helper.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1392 msedge.exe
1392 msedge.exe
1392 msedge.exe
1392 msedge.exe
1392 msedge.exe
1392 msedge.exe
1392 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

aspnet_compiler.exe

description pid process

Token: SeDebugPrivilege 1552 aspnet_compiler.exe

description	pid	process
Token: SeDebugPrivilege	1552	aspnet_compiler.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Заказ на покупку_(P.O_6203445-2024)_Викторович ООО.exePO.exeW.exemsedge.exeWG.exe

description	pid	process	target process
PID 4368 wrote to memory of 5028	4368	Заказ на покупку_(P.O_6203445-2024)_Викторович ООО.exe	PO.exe
PID 4368 wrote to memory of 5028	4368	Заказ на покупку_(P.O_6203445-2024)_Викторович ООО.exe	PO.exe
PID 4368 wrote to memory of 5028	4368	Заказ на покупку_(P.O_6203445-2024)_Викторович ООО.exe	PO.exe
PID 5028 wrote to memory of 4944	5028	PO.exe	W.exe
PID 5028 wrote to memory of 4944	5028	PO.exe	W.exe
PID 5028 wrote to memory of 4944	5028	PO.exe	W.exe
PID 4944 wrote to memory of 3872	4944	W.exe	WG.exe
PID 4944 wrote to memory of 3872	4944	W.exe	WG.exe
PID 4944 wrote to memory of 1392	4944	W.exe	msedge.exe
PID 4944 wrote to memory of 1392	4944	W.exe	msedge.exe
PID 1392 wrote to memory of 728	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 728	1392	msedge.exe	msedge.exe
PID 3872 wrote to memory of 1552	3872	WG.exe	aspnet_compiler.exe
PID 3872 wrote to memory of 1552	3872	WG.exe	aspnet_compiler.exe
PID 3872 wrote to memory of 1552	3872	WG.exe	aspnet_compiler.exe
PID 3872 wrote to memory of 1552	3872	WG.exe	aspnet_compiler.exe
PID 3872 wrote to memory of 1552	3872	WG.exe	aspnet_compiler.exe
PID 3872 wrote to memory of 1552	3872	WG.exe	aspnet_compiler.exe
PID 3872 wrote to memory of 1552	3872	WG.exe	aspnet_compiler.exe
PID 3872 wrote to memory of 1552	3872	WG.exe	aspnet_compiler.exe
PID 3872 wrote to memory of 1552	3872	WG.exe	aspnet_compiler.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1796	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 5032	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 5032	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 3812	1392	msedge.exe	msedge.exe

outlook_office_path 1 IoCs

Processes:

aspnet_compiler.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe

outlook_win_path 1 IoCs

Processes:

aspnet_compiler.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\Заказ на покупку_(P.O_6203445-2024)_Викторович ООО.exe
"C:\Users\Admin\AppData\Local\Temp\Заказ на покупку_(P.O_6203445-2024)_Викторович ООО.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4368

C:\Users\Admin\AppData\Local\Temp\PO.exe
"C:\Users\Admin\AppData\Local\Temp\PO.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028

C:\Users\Admin\AppData\Local\Temp\W.exe
"C:\Users\Admin\AppData\Local\Temp\W.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944

C:\Users\Admin\AppData\Local\Temp\WG.exe
"C:\Users\Admin\AppData\Local\Temp\WG.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3872

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
5⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\P.pdf
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc463f46f8,0x7ffc463f4708,0x7ffc463f4718
5⤵
PID:728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13956535888392932989,12827784118896286985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13956535888392932989,12827784118896286985,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
5⤵
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13956535888392932989,12827784118896286985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
5⤵
PID:3812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13956535888392932989,12827784118896286985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
5⤵
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13956535888392932989,12827784118896286985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
5⤵
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13956535888392932989,12827784118896286985,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
5⤵
PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2112,13956535888392932989,12827784118896286985,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=4512 /prefetch:6
5⤵
PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13956535888392932989,12827784118896286985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
5⤵
PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13956535888392932989,12827784118896286985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
5⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13956535888392932989,12827784118896286985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
5⤵
PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13956535888392932989,12827784118896286985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13956535888392932989,12827784118896286985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
5⤵
PID:1592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13956535888392932989,12827784118896286985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
5⤵
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13956535888392932989,12827784118896286985,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3000 /prefetch:2
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
eeeb1a3a706ffd8a649ef387bf2933dc

SHA1
a4eae1abce09e77de79a3b6dc87edb66060d1079

SHA256
e2f580afce37bb4d70d2cab7edb3f33e32eba7b90755d7db4841ebb3d8199b1f

SHA512
c3fe189a4eedb173c204fc614c6025719338165e3bbb50fad4cea63b62455b63a5c9adaae5bb4b8d8c447ad9f88a3791db3ac218a281b7c27326ef2b9b3e82d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
1f018092708277655efbb2b28ac600f3

SHA1
1801085cbd730e11f58ee8b425d22cbda5536549

SHA256
171f5f457ceddcbb3812bd4e79d0e049ddc0e26620833bd4aa44697884c9d798

SHA512
aaac768a38d00c06800c892fc3b4fad2454e0ddb56dcfc0db96d091009a23569b7e5e4bfb534d840ab9a9eb13d847a85a5c5ed34c0b9d7c638af113927fbb21c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
3f36488acf3993e3c2136f4ae8f34b28

SHA1
e7c03ceb7bbbf9e76edc832287b59bd20631aa74

SHA256
302c2b5fca346457c535440a792d2d5793aae6b38e9e1a2275d4acf07dc4c422

SHA512
8e23ba9a3412ded2d601d5fe58f7e47bdb99cafd966af29c879863f68ed88a99ffbeeca212fd047859172643e93fd31984dbdc6dbc43c0de16b84d692efc0aa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\P.pdf
Filesize
4KB

MD5
f560e00f53dea14bd7fc6125f13aa825

SHA1
d51ca79113f079bca8ff2f3e449489beff506622

SHA256
c793a9db38275862d5d8bf78842fbd3c816cccdfa1bcd4480016dedfa0c80a0e

SHA512
afc3efe32b1650814d469b0d23a78326b44b43a7e6facccdbaaa00b06afa9c0e9ba74676542212ac082661686000575bc895d07b1b510d57053f30058508c8f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\PO.exe
Filesize
513KB

MD5
9b99b4202796125646f24b24f3779221

SHA1
db870727d2617c9633ea606d171f2d96f95ba2e1

SHA256
77d2b275a0eddc02d7e2fa674bb9917d77132bdb4ee41f042b862b2aefe17816

SHA512
2247560b8b6c095fcb47787c89e5f94a28cfcb9ca8685729987615ca5f2f2ae2d938fb6042cc5a13a9e18eb503e63145e4ed30d28571ad7870378a0c253dfc45

Download Submit
C:\Users\Admin\AppData\Local\Temp\W.exe
Filesize
374KB

MD5
9e5f4dcd874e97732be7d34c3a86867e

SHA1
768133c43ea0afa420bd6920bfbaf5941611c570

SHA256
70fcbefcbb4183a1235d74c7e18baf7deaa1baa5fa7d25bad6a82af4eb7ec087

SHA512
aa60572e25cfb762b7a46502f8a3d0cd502a7d81c0016c4b27c04cb2a941fe70bd899900bdb6cd37831db19ab6220c11f06ebec7e535daf40b9b171617d98190

Download Submit
C:\Users\Admin\AppData\Local\Temp\WG.exe
Filesize
162KB

MD5
c8b4d9698c953b74a2445cb0f332b6e9

SHA1
8afd87832afb293bb4c8df009372ba99a0bc11f6

SHA256
127b554df0df16afcc669913442e0a931ca2b0aa27081a19f9d7e9cb3dbd85cb

SHA512
b8e3fe78439ebf6b8db042a7912b23168191cd342b996887e0c91a404ba969441793de83a2a7230a1e3111e23944394b59335b16bc132c26737ab8fd0b996fbd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3073191680-435865314-2862784915-1000\0f5007522459c86e95ffcc62f32308f1_eefe159c-12f0-419a-b98f-36c89e24da0c
Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3073191680-435865314-2862784915-1000\0f5007522459c86e95ffcc62f32308f1_eefe159c-12f0-419a-b98f-36c89e24da0c
Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
\??\pipe\LOCAL\crashpad_1392_KIFFQXBAKLIKPTDD
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1552-51-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1552-50-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1552-104-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1552-47-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1552-170-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3872-52-0x00007FFC465C0000-0x00007FFC47081000-memory.dmp

Filesize
10.8MB

Download
memory/3872-45-0x000000001AFF0000-0x000000001B000000-memory.dmp

Filesize
64KB

Download
memory/3872-46-0x00000000009E0000-0x00000000009EA000-memory.dmp

Filesize
40KB

Download
memory/3872-39-0x00007FFC465C0000-0x00007FFC47081000-memory.dmp

Filesize
10.8MB

Download
memory/3872-37-0x0000000000210000-0x0000000000240000-memory.dmp

Filesize
192KB

Download