mystic | 08bc11d00eb56ac42fa5376b47d28c1dfc8fca1c9274b0f411e4fa6f10936793

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe
Size

876KB
MD5

7e9fae8d7cc1200ab396adb65ccc63eb
SHA1

40acce023862cd7dd0b1371a53adcd7a88c7727a
SHA256

7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38
SHA512

e1e8c3d4e3dab98ea34604b779fc1706b597034f60b198480956c59a54a08ee29c11fd4afb17c1e4ee7e760b3e77ac4587998c9d3e9e9cca6f3ea150afc55ebe
SSDEEP

24576:rysd2dsAJiOiIP7UXQWuM/72YHvyhovHR4JI:esd2KrOiISQUNo

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/1372-35-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/1372-36-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/1372-37-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/1372-39-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/4992-52-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	5io1fP6.exe

Executes dropped EXE 8 IoCs

pid	Process
2460	IF8nR03.exe
3080	rW1MH58.exe
2136	xp3Za77.exe
4864	1So65hY3.exe
880	2Pf8143.exe
2360	3tA26Tn.exe
3600	4DN776rK.exe
4932	5io1fP6.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	IF8nR03.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	rW1MH58.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	xp3Za77.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4864 set thread context of 1116	4864	1So65hY3.exe	101
PID 880 set thread context of 1372	880	2Pf8143.exe	113
PID 2360 set thread context of 3884	2360	3tA26Tn.exe	120
PID 3600 set thread context of 4992	3600	4DN776rK.exe	126

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
380	4864	WerFault.exe	96
2300	880	WerFault.exe	107
828	1372	WerFault.exe	113
4292	2360	WerFault.exe	118
3096	3600	WerFault.exe	123

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1904519900-954640453-4250331663-1000\{417986D1-79AD-457F-97C0-6CEF61452149}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1116	AppLaunch.exe
1116	AppLaunch.exe
1116	AppLaunch.exe
3884	AppLaunch.exe
3884	AppLaunch.exe
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3884	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1116	AppLaunch.exe
Token: SeShutdownPrivilege	3544	Process not Found
Token: SeCreatePagefilePrivilege	3544	Process not Found
Token: SeShutdownPrivilege	3544	Process not Found
Token: SeCreatePagefilePrivilege	3544	Process not Found
Token: SeShutdownPrivilege	3544	Process not Found
Token: SeCreatePagefilePrivilege	3544	Process not Found
Token: SeShutdownPrivilege	3544	Process not Found
Token: SeCreatePagefilePrivilege	3544	Process not Found

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3544	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 2460	4544	7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe	92
PID 4544 wrote to memory of 2460	4544	7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe	92
PID 4544 wrote to memory of 2460	4544	7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe	92
PID 2460 wrote to memory of 3080	2460	IF8nR03.exe	94
PID 2460 wrote to memory of 3080	2460	IF8nR03.exe	94
PID 2460 wrote to memory of 3080	2460	IF8nR03.exe	94
PID 3080 wrote to memory of 2136	3080	rW1MH58.exe	95
PID 3080 wrote to memory of 2136	3080	rW1MH58.exe	95
PID 3080 wrote to memory of 2136	3080	rW1MH58.exe	95
PID 2136 wrote to memory of 4864	2136	xp3Za77.exe	96
PID 2136 wrote to memory of 4864	2136	xp3Za77.exe	96
PID 2136 wrote to memory of 4864	2136	xp3Za77.exe	96
PID 4864 wrote to memory of 1116	4864	1So65hY3.exe	101
PID 4864 wrote to memory of 1116	4864	1So65hY3.exe	101
PID 4864 wrote to memory of 1116	4864	1So65hY3.exe	101
PID 4864 wrote to memory of 1116	4864	1So65hY3.exe	101
PID 4864 wrote to memory of 1116	4864	1So65hY3.exe	101
PID 4864 wrote to memory of 1116	4864	1So65hY3.exe	101
PID 4864 wrote to memory of 1116	4864	1So65hY3.exe	101
PID 4864 wrote to memory of 1116	4864	1So65hY3.exe	101
PID 2136 wrote to memory of 880	2136	xp3Za77.exe	107
PID 2136 wrote to memory of 880	2136	xp3Za77.exe	107
PID 2136 wrote to memory of 880	2136	xp3Za77.exe	107
PID 880 wrote to memory of 1372	880	2Pf8143.exe	113
PID 880 wrote to memory of 1372	880	2Pf8143.exe	113
PID 880 wrote to memory of 1372	880	2Pf8143.exe	113
PID 880 wrote to memory of 1372	880	2Pf8143.exe	113
PID 880 wrote to memory of 1372	880	2Pf8143.exe	113
PID 880 wrote to memory of 1372	880	2Pf8143.exe	113
PID 880 wrote to memory of 1372	880	2Pf8143.exe	113
PID 880 wrote to memory of 1372	880	2Pf8143.exe	113
PID 880 wrote to memory of 1372	880	2Pf8143.exe	113
PID 880 wrote to memory of 1372	880	2Pf8143.exe	113
PID 3080 wrote to memory of 2360	3080	rW1MH58.exe	118
PID 3080 wrote to memory of 2360	3080	rW1MH58.exe	118
PID 3080 wrote to memory of 2360	3080	rW1MH58.exe	118
PID 2360 wrote to memory of 3884	2360	3tA26Tn.exe	120
PID 2360 wrote to memory of 3884	2360	3tA26Tn.exe	120
PID 2360 wrote to memory of 3884	2360	3tA26Tn.exe	120
PID 2360 wrote to memory of 3884	2360	3tA26Tn.exe	120
PID 2360 wrote to memory of 3884	2360	3tA26Tn.exe	120
PID 2360 wrote to memory of 3884	2360	3tA26Tn.exe	120
PID 2460 wrote to memory of 3600	2460	IF8nR03.exe	123
PID 2460 wrote to memory of 3600	2460	IF8nR03.exe	123
PID 2460 wrote to memory of 3600	2460	IF8nR03.exe	123
PID 3600 wrote to memory of 4992	3600	4DN776rK.exe	126
PID 3600 wrote to memory of 4992	3600	4DN776rK.exe	126
PID 3600 wrote to memory of 4992	3600	4DN776rK.exe	126
PID 3600 wrote to memory of 4992	3600	4DN776rK.exe	126
PID 3600 wrote to memory of 4992	3600	4DN776rK.exe	126
PID 3600 wrote to memory of 4992	3600	4DN776rK.exe	126
PID 3600 wrote to memory of 4992	3600	4DN776rK.exe	126
PID 3600 wrote to memory of 4992	3600	4DN776rK.exe	126
PID 4544 wrote to memory of 4932	4544	7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe	129
PID 4544 wrote to memory of 4932	4544	7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe	129
PID 4544 wrote to memory of 4932	4544	7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe	129
PID 4932 wrote to memory of 4204	4932	5io1fP6.exe	130
PID 4932 wrote to memory of 4204	4932	5io1fP6.exe	130
PID 4204 wrote to memory of 1588	4204	cmd.exe	133
PID 4204 wrote to memory of 1588	4204	cmd.exe	133
PID 4204 wrote to memory of 3688	4204	cmd.exe	134
PID 4204 wrote to memory of 3688	4204	cmd.exe	134
PID 4204 wrote to memory of 5060	4204	cmd.exe	135
PID 4204 wrote to memory of 5060	4204	cmd.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe
"C:\Users\Admin\AppData\Local\Temp\7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IF8nR03.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IF8nR03.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rW1MH58.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rW1MH58.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xp3Za77.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xp3Za77.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1So65hY3.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1So65hY3.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4864
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1116
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 552
        6⤵
        Program crash
        
        PID:380
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Pf8143.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Pf8143.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:880
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 560
        7⤵
        Program crash
        
        PID:828
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 152
        6⤵
        Program crash
        
        PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3tA26Tn.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3tA26Tn.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2360
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:3884
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 148
        5⤵
        Program crash
        
        PID:4292
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4DN776rK.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4DN776rK.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4992
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 136
      4⤵
      Program crash
      PID:3096
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5io1fP6.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5io1fP6.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D3A.tmp\D3B.tmp\D3C.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5io1fP6.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4864 -ip 4864
1⤵
PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 880 -ip 880
1⤵
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1372 -ip 1372
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2360 -ip 2360
1⤵
PID:380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3600 -ip 3600
1⤵
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=3708 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:1
1⤵
PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5360 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:1
1⤵
PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=4960 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:1
1⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=4676 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:1
1⤵
PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4584 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:8
1⤵
PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=6020 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:1
1⤵
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4844 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:8
1⤵
PID:3808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=6364 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:8
1⤵
PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6512 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:8
1⤵
- Modifies registry class
PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6224 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:8
1⤵
PID:2192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:8
1⤵
PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\D3A.tmp\D3B.tmp\D3C.bat

Filesize
124B

MD5
dec89e5682445d71376896eac0d62d8b

SHA1
c5ae3197d3c2faf3dea137719c804ab215022ea6

SHA256
c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668

SHA512
b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5io1fP6.exe

Filesize
87KB

MD5
06d1908205c135c7fe93df36f5dbba84

SHA1
78a66efe772f4f5692f45fd26247eaf77791a77e

SHA256
0bf7a759e5ecc802a9a16031fb4849703ddda47e6a9d794fe005e3614f7ee1d6

SHA512
d4ca7f9e2ab52e720404bc6d09afba396572cd8661888d2306af7cf9ffd302cd2ae6c591f967a67b73601f42f47d60a29561d107b1ce06c540025f703af2afec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IF8nR03.exe

Filesize
738KB

MD5
a71a785a3686cd9ff9465cdeceff1611

SHA1
2e624e0b19fbcd8f120df26acb19360736334198

SHA256
13a5f773d65c07b7f5ee20421d08c928be9a58138676906022dfb879734631f5

SHA512
04d46fbb03098d9818d824ba8e95f97336ce19efd83eda812af56a12f7527e95bc1914425338ff143b43cc961987b768f1a624cd9c0f241c7ba957d77d5196b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4DN776rK.exe

Filesize
339KB

MD5
ff3979268d2c0ea521da7961f76334af

SHA1
5d43705a235f70a7a2fdda1b26a52cbfbac92982

SHA256
13cb70b2a2c54e9c478767103c94eca9ab655c4d95ae96c2d15687f938f1054a

SHA512
869c7818524bcb90c457fe2293f2ca10dd3792d7b25a00987d80e18bf217e16f4ff603285b0ee64faea5f5753651f4b3363debf6208e2c5901af3bc38919e838

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rW1MH58.exe

Filesize
502KB

MD5
7162429f5e1580fbe2f41b267f316e5d

SHA1
4c65898480d15f2052d8459e9d09918b517c3d28

SHA256
da71bd468a4c89ba4f1ba99dadc5648ad415cbc7ade3f87a4bde05f0c77d200b

SHA512
2ca05fa578dd1bd03aa60f98d1614b2755feeca8e9f76de8fb5c62be779b42baeb38b9d35b4d656bd61309ef50008bddc869763d1c79a7f72992cf227e6eb31f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3tA26Tn.exe

Filesize
148KB

MD5
79d7a9efeb59749776c3fd31bb0769e2

SHA1
b68539d91d51cba2e842070c35dd6b25cc75e291

SHA256
e354c75047b440a71be2d1d1a3ec07507d9991e8b1e8352f90299a35dfb68541

SHA512
76a732683ce9ba34c0bd7a4f6b51da3209bb55c1ba08d3e6fed9e63b53485514bc792a67eab66b2521f6ddc8ffbfdeaecfc25b1b9bbbac2b6d56c48e10d02377

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xp3Za77.exe

Filesize
317KB

MD5
f7cbe5ba92cce2bbf14962bea959bab3

SHA1
40f866268cb16d401214469c94732b8e9a68e38b

SHA256
8ac5c0c5aafa012024120ebacb01cdf334a2143bb2c037f6d7bf2a79a3527292

SHA512
d3a2eb290d31b212644addb540d8b13af33f7cc29b21a42fad2715d84b247f2806aeaeb792504154a87ca2bba1b381c5493fa120efc67b69371b8a4341aee09f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1So65hY3.exe

Filesize
129KB

MD5
4ed940ea493451635145489ffbdec386

SHA1
4b5d0ba229b8ac04f753864c1170da0070673e35

SHA256
b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa

SHA512
8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Pf8143.exe

Filesize
298KB

MD5
e4c4819cfac962973a06d2504b8eeab7

SHA1
9dd189df8641d92036ef97822cb2a6d661f31721

SHA256
0597b863a6bccebf40642317b422f4ace6e7b9a9c312c4f77c94ccef90c5e18c

SHA512
62b106e0086390d685435d3bf768163305f9d780216d586453c7255f5766cec2559a66699e69d54756c1a7c52782b052f9496e85d99ac44e48f4f26bae07b39b

Download Submit
memory/1116-28-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1116-34-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/1116-29-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/1372-39-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1372-37-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1372-36-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1372-35-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3544-48-0x00000000007E0000-0x00000000007F6000-memory.dmp

Filesize
88KB

Download
memory/3884-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3884-51-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3884-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4992-63-0x0000000008B50000-0x0000000009168000-memory.dmp

Filesize
6.1MB

Download
memory/4992-56-0x0000000007AB0000-0x0000000007B42000-memory.dmp

Filesize
584KB

Download
memory/4992-57-0x0000000007CB0000-0x0000000007CC0000-memory.dmp

Filesize
64KB

Download
memory/4992-58-0x0000000007CC0000-0x0000000007CCA000-memory.dmp

Filesize
40KB

Download
memory/4992-55-0x0000000007F80000-0x0000000008524000-memory.dmp

Filesize
5.6MB

Download
memory/4992-52-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4992-64-0x0000000007E60000-0x0000000007F6A000-memory.dmp

Filesize
1.0MB

Download
memory/4992-65-0x0000000007D90000-0x0000000007DA2000-memory.dmp

Filesize
72KB

Download
memory/4992-66-0x0000000007DF0000-0x0000000007E2C000-memory.dmp

Filesize
240KB

Download
memory/4992-67-0x0000000008530000-0x000000000857C000-memory.dmp

Filesize
304KB

Download
memory/4992-54-0x00000000740D0000-0x0000000074880000-memory.dmp

Filesize
7.7MB

Download
memory/4992-73-0x00000000740D0000-0x0000000074880000-memory.dmp

Filesize
7.7MB

Download
memory/4992-74-0x0000000007CB0000-0x0000000007CC0000-memory.dmp

Filesize
64KB

Download