metasploit | 77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50

Analysis

max time kernel
157s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
Size

1.8MB
MD5

774b60a0622c2296aeb181ee26421c20
SHA1

5b744cf350993d77145c7d7a69c689b045b34426
SHA256

77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50
SHA512

7b5b4089042073ebe7e5c97e70c17a6b5b6b7e8d842ab4f01f9a075586f585ab102186a9a244ea040ea22bcdea9ec99df8a78dd1c797d2dde033a41b7dcfee29
SSDEEP

24576:/3vLRdVhZBK8NogWYO09gOGi9J3YiWdCMJ5QxmjwC/hR:/3d5ZQ1MxJIiW0MbQxA

Score

10^/10

metasploit backdoor discovery spyware stealer trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

1.15.12.73:4567

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Drops file in Drivers directory 1 IoCs

Processes:

77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe

description	ioc	process
File opened (read-only)	\??\A:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\E:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\L:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\O:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\W:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\Z:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\M:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\N:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\P:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\Q:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\R:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\B:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\G:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\I:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\J:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\T:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\U:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\V:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\H:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\K:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\S:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\X:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
File opened (read-only)	\??\Y:	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

1604 msedge.exe
1604 msedge.exe
4456 msedge.exe
4456 msedge.exe
3752 identity_helper.exe
3752 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

4456 msedge.exe
4456 msedge.exe
4456 msedge.exe
4456 msedge.exe
4456 msedge.exe
4456 msedge.exe
4456 msedge.exe
4456 msedge.exe

pid	process
1604	msedge.exe
1604	msedge.exe
4456	msedge.exe
4456	msedge.exe
3752	identity_helper.exe
3752	identity_helper.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe

description	pid	process
Token: SeDebugPrivilege	1996	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
Token: SeDebugPrivilege	1996	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
Token: SeDebugPrivilege	4932	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
Token: SeDebugPrivilege	4932	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exemsedge.exe

description	pid	process	target process
PID 1996 wrote to memory of 4932	1996	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
PID 1996 wrote to memory of 4932	1996	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
PID 1996 wrote to memory of 4932	1996	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
PID 4932 wrote to memory of 4456	4932	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe	msedge.exe
PID 4932 wrote to memory of 4456	4932	77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe	msedge.exe
PID 4456 wrote to memory of 1336	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1336	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 3392	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1604	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 1604	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2184	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2184	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2184	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2184	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2184	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2184	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2184	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2184	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2184	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2184	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2184	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2184	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2184	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2184	4456	msedge.exe	msedge.exe
PID 4456 wrote to memory of 2184	4456	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
"C:\Users\Admin\AppData\Local\Temp\77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Local\Temp\77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe
"C:\Users\Admin\AppData\Local\Temp\77c9992fc041f54cd629d46ac91d3c5e8d889cdfcb89cc60be31bc710c045b50.exe" Admin
2⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm
3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf75746f8,0x7ffcf7574708,0x7ffcf7574718
4⤵
PID:1336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,931922372581488139,8453173244532935119,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2312 /prefetch:2
4⤵
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,931922372581488139,8453173244532935119,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,931922372581488139,8453173244532935119,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
4⤵
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,931922372581488139,8453173244532935119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
4⤵
PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,931922372581488139,8453173244532935119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
4⤵
PID:164

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,931922372581488139,8453173244532935119,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
4⤵
PID:1160

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,931922372581488139,8453173244532935119,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,931922372581488139,8453173244532935119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
4⤵
PID:740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,931922372581488139,8453173244532935119,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
4⤵
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,931922372581488139,8453173244532935119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
4⤵
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,931922372581488139,8453173244532935119,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
4⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,931922372581488139,8453173244532935119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
4⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,931922372581488139,8453173244532935119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
4⤵
PID:4776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
864aa9768ef47143c455b31fd314d660

SHA1
09d879e0e77698f28b435ed0e7d8e166e28fafa2

SHA256
3118d55d1f04ecdd849971d8c49896b5c874bdbea63e5288547b9812c0640e10

SHA512
75dce411fce8166c8905ed8da910adb1dd08ab1c9d7cd5431ef905531f2f0374caf73dedd5d238b457ece61273f6c81e632d23eb8409efbb6bf0d01442008488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e2ece0fcb9f6256efba522462a9a9288

SHA1
ccc599f64d30e15833b45c7e52924d4bd2f54acb

SHA256
0eff6f3011208a312a1010db0620bb6680fe49d4fa3344930302e950b74ad005

SHA512
ead68dd972cfb1eccc194572279ae3e4ac989546bfb9e8d511c6bc178fc12aaebd20b49860d2b70ac1f5d4236b0df1b484a979b926edbe23f281b8139ff1a9ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b15472a2355d3ce0074fbd8c57b449b7

SHA1
6d1acd934841caa4281e57bcc176d062fe18a92a

SHA256
4be802d27c3ba5feb1cdb57f271fd3004e37c95a7f26eb71b385e44dbe74c65f

SHA512
5e4ee50e2a711fbf910b4f9c14a61196b29170877c5cbebc433e9764a529bdf4626239ec910191ed65f62c2db1524f05fda7fa5c086ada26912c095bac8dc807

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
977f65f039d9cb8175d341685c81329d

SHA1
dfa889d70f7760f591af5d443611f7d4631acd75

SHA256
3afef23ac47933ab462420faf76cbb6eab6dbdfad246583f1be2fe693f47083b

SHA512
9f59b341d38b9e48707613ed30096ef1ae92ba93bb74d08fff128e99bcc6ab103c528feb23b3ad49f1c07996bee35e656b9709257d36a6c7b1ae2582986bc434

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
479acad810e8639f20aa59e23fccaad1

SHA1
6289f8028f0c620745404eee540bcf6540ce3a69

SHA256
e9907d7fb6bcbadd40a68e8ed0e300cc8e331c036fb244d1546ebe07dcb82d9d

SHA512
1568c0e87fcec3bd34f48818f719d5bcaffd5155d967555b9b01552ee20ac844ae50ec5db7355dfb777caa12e4cfffba09e5e23c7f62fc83683990a739cb06d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
769eea086085ae0ce2139e15092af54c

SHA1
91e183e767b96231da735b76041b806f2e3a2f4b

SHA256
83ec12af443933540b0f33b64ecb9188813a4cf59c41004fbbc9db0ccc474b85

SHA512
f0bac9366c808c8fded1ba8fd8183ab6ebe773df7193ddf87e189c5e26510c272ce914879ccbcf819016dd2d0a0f14f22377af5565df9a01998ad1f4dc16d34f

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
822B

MD5
03450e8ddb20859f242195450c19b8f1

SHA1
9698f8caf67c8853e14c8bf4933949f458c3044a

SHA256
1bdd8f1dd7bd82b5b2313d8770dfe4f41cd3f45bbaeab8b8a7f75fc5e2d3720b

SHA512
87371e57bf2296af5ec7f5db772a4ce66729d54aa23a8b384e3f4c42310b97b636576c7dff67c27a3b679339cdeee05b836563ae2a878f0367caf247b3e1ba7b

Download Submit
\??\pipe\LOCAL\crashpad_4456_HSJFXVAWAGIAGDZO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1996-4-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/1996-0-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/1996-2-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/1996-1-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/4932-10-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/4932-22-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/4932-21-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/4932-20-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/4932-18-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/4932-13-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/4932-12-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/4932-11-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/4932-9-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/4932-6-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download