Analysis
-
max time kernel
110s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 19:02
Static task
static1
Behavioral task
behavioral1
Sample
Silver Rat [Re Lab].7z
Resource
win10v2004-20240226-en
General
-
Target
Silver Rat [Re Lab].7z
-
Size
10.6MB
-
MD5
f06813aa321c43a69a04904cfa735a44
-
SHA1
820a0f9f4c00af6ce2583218019ad14a5c5592e2
-
SHA256
a384bad25740a4b783eaadd6ade53d96e878e1313c34321ddfb23149fbf6366d
-
SHA512
72551e22ba2db4759ad905f92f407f7e8266e363aa8627a56d8bcaea83a69a96466269358a034e626581f24c2417fa98bb0bb57472f96c2ea39b2708edaa5bb8
-
SSDEEP
196608:vGbH8yKZWDv2mzFaZ9+j0PlI6obvU/Y0NK6HLlzcurSGBZ+pbJ:vGTiMLNaLIulI6z/YGJHp76P
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
SilverRat.exeSilverRat.exepid process 2244 SilverRat.exe 3160 SilverRat.exe -
Loads dropped DLL 20 IoCs
Processes:
SilverRat.exeSilverRat.exepid process 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 3160 SilverRat.exe 3160 SilverRat.exe 3160 SilverRat.exe 3160 SilverRat.exe 3160 SilverRat.exe 3160 SilverRat.exe 3160 SilverRat.exe 3160 SilverRat.exe 3160 SilverRat.exe 3160 SilverRat.exe -
Obfuscated with Agile.Net obfuscator 4 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule C:\Users\Admin\Desktop\Silver Rat [Re Lab]\bunifu.ui.winforms.1.5.3.dll agile_net behavioral1/memory/2244-606-0x0000000007D90000-0x0000000007DDE000-memory.dmp agile_net C:\Users\Admin\Desktop\Silver Rat [Re Lab]\Bunifu.Licensing.dll agile_net behavioral1/memory/2244-618-0x0000000009860000-0x00000000099AE000-memory.dmp agile_net -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4816 2244 WerFault.exe SilverRat.exe 2504 2244 WerFault.exe SilverRat.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 4 IoCs
Processes:
cmd.exe7zFM.exemsedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 7zFM.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 7zFM.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-566096764-1992588923-1249862864-1000\{64B31B86-D89F-46A4-AC25-F631C4F9B289} msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exeSilverRat.exepid process 4304 msedge.exe 4304 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4960 msedge.exe 4960 msedge.exe 4692 identity_helper.exe 4692 identity_helper.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe 2244 SilverRat.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7zFM.exepid process 1536 7zFM.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
msedge.exepid process 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
7zFM.exeSilverRat.exeSilverRat.exedescription pid process Token: SeRestorePrivilege 1536 7zFM.exe Token: 35 1536 7zFM.exe Token: SeSecurityPrivilege 1536 7zFM.exe Token: SeSecurityPrivilege 1536 7zFM.exe Token: SeDebugPrivilege 2244 SilverRat.exe Token: SeDebugPrivilege 3160 SilverRat.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
Processes:
7zFM.exemsedge.exepid process 1536 7zFM.exe 1536 7zFM.exe 1536 7zFM.exe 1536 7zFM.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exemsedge.exedescription pid process target process PID 2828 wrote to memory of 1536 2828 cmd.exe 7zFM.exe PID 2828 wrote to memory of 1536 2828 cmd.exe 7zFM.exe PID 4616 wrote to memory of 5036 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 5036 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4284 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4304 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 4304 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe PID 4616 wrote to memory of 2072 4616 msedge.exe msedge.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Silver Rat [Re Lab].7z"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Silver Rat [Re Lab].7z"2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd753546f8,0x7ffd75354708,0x7ffd753547182⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9515880481926150527,13222190575353993275,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:4284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9515880481926150527,13222190575353993275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9515880481926150527,13222190575353993275,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:82⤵PID:2072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9515880481926150527,13222190575353993275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:12⤵PID:996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9515880481926150527,13222190575353993275,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:12⤵PID:2912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9515880481926150527,13222190575353993275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:12⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9515880481926150527,13222190575353993275,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:12⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9515880481926150527,13222190575353993275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:12⤵PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9515880481926150527,13222190575353993275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:12⤵PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,9515880481926150527,13222190575353993275,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3628 /prefetch:82⤵PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2100,9515880481926150527,13222190575353993275,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2372 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9515880481926150527,13222190575353993275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:12⤵PID:224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9515880481926150527,13222190575353993275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:82⤵PID:3296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9515880481926150527,13222190575353993275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9515880481926150527,13222190575353993275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9515880481926150527,13222190575353993275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:12⤵PID:4512
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:452
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1976
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1244
-
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe"C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2244 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 12682⤵
- Program crash
PID:4816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 12682⤵
- Program crash
PID:2504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2244 -ip 22441⤵PID:4188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2244 -ip 22441⤵PID:4424
-
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe"C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3160
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59ffb5f81e8eccd0963c46cbfea1abc20
SHA1a02a610afd3543de215565bc488a4343bb5c1a59
SHA2563a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
SHA5122d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
-
Filesize
152B
MD5e1b45169ebca0dceadb0f45697799d62
SHA1803604277318898e6f5c6fb92270ca83b5609cd5
SHA2564c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
SHA512357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
-
Filesize
64KB
MD5d6b36c7d4b06f140f860ddc91a4c659c
SHA1ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA25634013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
SHA5122a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
-
Filesize
69KB
MD5a127a49f49671771565e01d883a5e4fa
SHA109ec098e238b34c09406628c6bee1b81472fc003
SHA2563f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6
SHA51261b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734
-
Filesize
35KB
MD5bd72bbee586e1ccd001d0b09fb4a0479
SHA1d6a9f9e658642090a2982ce8b7c59571ec126d9b
SHA256d396d7e26505c676cd1bc38ab1c1875417d68120235f79199c40f4f8fcea58cc
SHA5125b8c5b52edfd060c015b3ead4db3307b56b7de5d90b30022026bd648f694da3a6c033e569ae2fb88e456d3860aa19c63bac5acd4c7cb1ff57b35b57acf534813
-
Filesize
19KB
MD52e86a72f4e82614cd4842950d2e0a716
SHA1d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA256c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
SHA5127a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
-
Filesize
65KB
MD556d57bc655526551f217536f19195495
SHA128b430886d1220855a805d78dc5d6414aeee6995
SHA256f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
SHA5127814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
-
Filesize
88KB
MD5b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1386ba241790252df01a6a028b3238de2f995a559
SHA256b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
SHA512546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
-
Filesize
1.1MB
MD5e121064892c625fc705091652713eef7
SHA1244258d146eb167e4eee2b443f80248eac1d7f72
SHA2563d89538ba00ff93f6099d3d896698403eff6d920061eb377b7c88e4e49b9bbe2
SHA5129092236c62017d6f715d936ab66ad40ecf44f9ab95e50c9e65b9766b5c0a9a3ff022b71c701a3fa3d2375c4e6520b1cdc905b81541ddfe0a1f1543d483e0bdbd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5a17bb15bbc0e76706c51fdf951e8a7a9
SHA11fbd3b0c1e49d44b6fe964c4f130112f8bc26b18
SHA2565bde0a27b1269f26cd9b473c222b6d0241348dca386cd928c41ecdd5636dbb3d
SHA512480fa7980e5e35bd1409106809a666a22c0a3fba1af00dc426465f0563e20578d9188d16bb3bfe58c205b3a75163b8b1a1ef19228ab2c4d6da974502869d9dbb
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
1KB
MD59542b199d8aef21462a56f5169246829
SHA1e7c577956aef599013e3b739a140c5d8e4365aa1
SHA25676da9f47a2fed827df37f19fd72fc2085e081473b0096819f3411b0a20fb9546
SHA512377c2aa7316bbe6b8e2dc8c1bc4c5b414e7174611a2170f046247c776d72f1101130aeaef5e6d9d8c4599843db3972f739df179dcfb14ca9ce60de16924a7f90
-
Filesize
6KB
MD50f99f08ed6ec9701311db22f71880b6e
SHA18c08b5639b32898289f52f21106cc824616ae1b5
SHA256e1196e13811e1d82c26ad613762eea56ecfefbb22209b565aaaa3f25e658e92a
SHA512ffed5aa0ad3a40e734f01a1962bab7feac064434936c8932d28edb8edabbdc8cbdf929af1b351121f5e53f3933c59b8755b528c595b6eafc73f24e673c84b916
-
Filesize
6KB
MD501be6399e1e2b9da1f701f2cef3e1cf7
SHA1d567cff188e9665d7bf2a2463a35de890a271117
SHA256cc8ad56274a26160277d355aa08cb5836390969f238172a85a4c9376e6560e51
SHA51250c35a24fdb582b57793919111298b4f646238e38d46403840ea69026fd2e52c76cb3222352ab3567025ffe370a8e4bbee36b03c5ebd283301b9536daf39660b
-
Filesize
7KB
MD528f5cbfa3ba9ff22743e39b839e940dd
SHA198670a697a33e872ab656abfddbfd61268662ee6
SHA2562412aa1117280b8d37cdbd6b030f55c5f68861ca93c14d7301d8e3f4e0366626
SHA512542f54d97477152fc3cae1232278fdb40476caf2471575df2b2c372ee9f7c510078586b369ffa30991d1af34e84415bdafd7543c18b52daab6925f4b1ea24bde
-
Filesize
873B
MD5100911dc0f9d5fa85c42aa67aae456f4
SHA1ce97ab330456508a75b911e04573d9e22bb9800e
SHA256bcc9829b28c99ca1d448854e7a634d4167de557e85b123cc14c0778c38e12eb0
SHA512c2c7952d7abb292303c858b297ec9aecd1be57aa82f7cfa4e30b9f8a2dcd8c3ef5e1051aee589ccebb3c4e181a9924573f950b2a92c916088e8a953fc52aecea
-
Filesize
538B
MD5e2abc4f4c30225ea38a80da3fc6fbf41
SHA165c286898bd4ea8265d3703c46d774c52cfc84be
SHA25630e5b3bb3937704e9d9854763d7cedf282bbfc015fb53cc2d1caf347447ff9db
SHA51246d6c710a23b74b049a6b8f79559fcb7017d89087efef035b322288bd202b239e9ef5b2aa8bb5b094a8b2ec8406577e7ce293fb3f0348fc6c8ace07877556af1
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD554cbd08cedabe80c2d566e6a9bbfc702
SHA1340a73d2f5ccc0d6b2bb8814556c16e27f4be182
SHA256f5848b4901fe199034518dcc8cd9e89f0aa06ea10a687861fa66bd37d8081de6
SHA5124bfe15be836807cf23fe35192fb20399288f99627b4ecbee801c3b2b26006ed13fba644b35416649e02dc7dac6a9f0a1107a9182ed6fdf0304797eb93e5c0b87
-
Filesize
11KB
MD5f4e84bf072bb2849e7cce71394f968c2
SHA1945659a5e0883f33871d1eba9eee52b0ab46cc4b
SHA25689d8d90431e904ad2399386408d2e0c54c2e1669e7ceb77dc6de5d1e2cb6ad04
SHA512ec8fe7afdd2e336ba499b9b9d99cb47986587e8eb11ad0a85b62931ac6fa5a4b7313d6a2b6e51c0aaa2c3bfbbf82156f3ba7bc0d428ee4cb88bc03b193895a74
-
Filesize
1.3MB
MD5c18a9e44e200c7315a1868caab894293
SHA118f65508762d2492f41b22e4e6e5ad19a2226baa
SHA256661a5be944dc9fb2e0eba01c3c0584feb3ecca44877d77f54d0f409ce801af22
SHA5129a5e08bb6ed4535ac92ca446b630b29587cb5a4d7d695234a5d93267d2ac13d702b3738ba0e20606f10020e9642e8e315e7ddc92f1c321b68daf8524a3f5f2d1
-
Filesize
1.4MB
MD5acec68d05e0b9b6c34a24da530dc07b2
SHA1015eb32aad6f5309296c3a88f0c5ab1ba451d41e
SHA256bf72939922afa2cd17071f5170b4a82d05bceb1fc33ce29cdfbc68dbb97f0277
SHA512d68d3ac62319178d3bc27a0f1e1762fc814a4da65156db90ae17284a99e5d9909e9e6348a4ff9ef0b92a46ba2033b838b75313307b46ab72dc0aab9641e4f700
-
Filesize
25.2MB
MD5d6527f7d5f5152c3f5fff6786e5c1606
SHA1e8da82b4a3d2b6bee04236162e5e46e636310ec6
SHA25679a4605d24d32f992d8e144202e980bb6b52bf8c9925b1498a1da59e50ac51f9
SHA5122b4eb9e66028d263c52b3da42fa3df256cf49cd7a7ebdf7c75da6a2dedfd2c22cb5f2071345b7016cd742539c74a801cad70c612330be79802fa19f860ea2d5f
-
Filesize
526B
MD5d6f1152d647b57f64494c3e1d32ede94
SHA1a35bd77be82c79a034660df07270467ee109f5ac
SHA256a47f3f83cdb9816f03632833dc361ac5e7a4c5c923af1fdebfa16303f9d68a72
SHA512699b5ad93d3497348f8aad8e15d54ddd789bbac43f11a7fb629f19cda3749bee0ae06dc83f4e6246df631488169fda5d15c48585581d3a96d2523b8b45e639bd
-
Filesize
297KB
MD5c1d51a0e747c9d6156410cb3c5b97a60
SHA186312cba2eb3495cc6bec66d54d4ab88596275d8
SHA2566937052b86bc251be510b110e08fc5089d3bd687ce2333a85ea6d5c2c09b437a
SHA512a8d7b2e5555c01076e8dd744d21d8cd901aaffad052af0e8c22269e8c2f765019422ed245368a64d64157652a0e4fcab1a889086fde4e139b4ccf5f7bad08222
-
Filesize
1.3MB
MD5686833fccd95b4f5c8d7695a2d45955d
SHA1882f60ea47f536c1f01da0f5767dfe5d569fc011
SHA256578cbcfb7a01234907fb6314918efd23a502882c79d0ee3c2e7d4ae0cf63ebc2
SHA5128bb3a8741b73ad7c280de31905dbfc449c2d6f538b8feca232201c7079f917c4291936211632bcdf17c95d6cf5d9b97df2cdd21c57af6cbff486ea7691ff3bc1
-
Filesize
2.3MB
MD56d6e172e7965d1250a4a6f8a0513aa9f
SHA1b0fd4f64e837f48682874251c93258ee2cbcad2b
SHA256d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
SHA51235daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e