njrat | f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
Size

713KB
MD5

6d9e7dfe7232852fa11e10c22a0a3ca2
SHA1

3054b9b8e28937b14cc600496adf3f92d44578db
SHA256

f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e
SHA512

aeec0d0d1dd863fae3adafbc4589c4f49af1addb14d29e2d0a85815e68609ccea66e27d532e154568ff466ce984f9392b907d6875e359304defe5256a45e4970
SSDEEP

6144:SsH4OjsU9q5eYEkRvPbD1r42soGOaWUcOf6mwR:SI49QYtvv1rarWWwR

Score

10^/10

njrat microsoft phishing trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

svhost.exe

pid process

432 svhost.exe

pid	process
432	svhost.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 1 IoCs

Processes:

f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe

description	pid	process	target process
PID 1796 set thread context of 432	1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe	svhost.exe

Drops file in Windows directory 3 IoCs

Processes:

f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
File opened for modification	C:\Windows\assembly	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
4716	msedge.exe
4716	msedge.exe
552	msedge.exe
552	msedge.exe
1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
1428	identity_helper.exe
1428	identity_helper.exe
1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

552 msedge.exe
552 msedge.exe
552 msedge.exe
552 msedge.exe
552 msedge.exe
552 msedge.exe
552 msedge.exe
552 msedge.exe
552 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe

description pid process

Token: SeDebugPrivilege 1796 f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe

description	pid	process
Token: SeDebugPrivilege	1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exesvhost.exemsedge.exe

description	pid	process	target process
PID 1796 wrote to memory of 432	1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe	svhost.exe
PID 1796 wrote to memory of 432	1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe	svhost.exe
PID 1796 wrote to memory of 432	1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe	svhost.exe
PID 1796 wrote to memory of 432	1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe	svhost.exe
PID 1796 wrote to memory of 432	1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe	svhost.exe
PID 1796 wrote to memory of 432	1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe	svhost.exe
PID 1796 wrote to memory of 432	1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe	svhost.exe
PID 1796 wrote to memory of 432	1796	f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe	svhost.exe
PID 432 wrote to memory of 552	432	svhost.exe	msedge.exe
PID 432 wrote to memory of 552	432	svhost.exe	msedge.exe
PID 552 wrote to memory of 4352	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4352	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4056	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4716	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 4716	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 1632	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 1632	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 1632	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 1632	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 1632	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 1632	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 1632	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 1632	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 1632	552	msedge.exe	msedge.exe
PID 552 wrote to memory of 1632	552	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe
"C:\Users\Admin\AppData\Local\Temp\f2540977c3b34608047c4b11a8ccd30ab01674e1d9a2d93290447e683f4d0b3e.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796

C:\Users\Admin\AppData\Local\Temp\svhost.exe
"C:\Users\Admin\AppData\Local\Temp\svhost.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svhost.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefb5546f8,0x7ffefb554708,0x7ffefb554718
4⤵
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,6131644693630647166,9125171372116172689,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
4⤵
PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,6131644693630647166,9125171372116172689,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,6131644693630647166,9125171372116172689,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
4⤵
PID:1632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,6131644693630647166,9125171372116172689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
4⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,6131644693630647166,9125171372116172689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
4⤵
PID:3504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,6131644693630647166,9125171372116172689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
4⤵
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,6131644693630647166,9125171372116172689,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3972 /prefetch:8
4⤵
PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,6131644693630647166,9125171372116172689,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3972 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,6131644693630647166,9125171372116172689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
4⤵
PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,6131644693630647166,9125171372116172689,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
4⤵
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,6131644693630647166,9125171372116172689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
4⤵
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,6131644693630647166,9125171372116172689,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
4⤵
PID:2652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,6131644693630647166,9125171372116172689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
4⤵
PID:5360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,6131644693630647166,9125171372116172689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
4⤵
PID:5440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,6131644693630647166,9125171372116172689,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:2
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svhost.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
3⤵
PID:5284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefb5546f8,0x7ffefb554708,0x7ffefb554718
4⤵
PID:5296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\08a562d2-46dd-44dd-9e8b-ec993e305f0b.tmp

Filesize
371B

MD5
80e521b46c75016de0fcee98c646cd8c

SHA1
22fa117adab176945868c9ba486336721ec94dd6

SHA256
0ce043949846831adec6c67546ad4e6ea661c2e580dbc71e0429e703c7faec3e

SHA512
56a3980b3b003a416ae307e7f2925f6f8a484d93fa457d36d883d45ea36d51fd588f7bee81efe3136d09b2ca5f10440cdd7a1418737fd19edc3c89ea8646ec90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
7b9d662d4e0cff84bf2dec685c1bcdaa

SHA1
6cfb9ede0437f8970318423b5605de5a94523f40

SHA256
340aaaa486f74b6b32b80dab4c5450a3f069a312556cce46d23da2061d90afd9

SHA512
640c331a4f0d3cd9ec589e7c4c945a098a1f24cf47e7a3017557c1551a210f612348f65bde79da247d6e31699434737a857dc16083ab6fc14539108f8ce99775

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2d48d4963f3436238195cc42a2f92373

SHA1
21ada95205701f6a0291cb904f3c3d58582f1e14

SHA256
c708d13d16d1340cb2d9db135e4890bb2df14e9e8055c10d9ba75ec3b8a39fbc

SHA512
6078f4c2cd31846773ee5638a72f9fb66313639e8f27e7658e8b95f16ebcde0e95f896ae8abdc2187420d472ac197008c6ff0b8aa52b1ea9f0db754b9f05351d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
698d93f58d5f48387f9b1e687a442467

SHA1
14572e2936d1d2eb6de6b23bed0a38262f2ba6a2

SHA256
ac40dedd497db5192a8b064ebed0987ef9f799c727bbd8e60293e427e4d23de3

SHA512
c78bf80b8a0eca525ba5ff4080fd93615d9f8ae93389cf53984dd993a09277b94311d769efe0008c302b640c785544c226426bbf6434118513f1c3e140a91d20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9844a6fbf71ddf25b7b02ffc39af668d

SHA1
c2e15ee5898fd1e64fd03c106705ed208404bfc0

SHA256
f8a33e3028e5b02cfa2899d890408939d727c6342547610795169ddab3c55ec5

SHA512
e3ef7977b94ff2535f64c3c843b5d2da943d8ffb44b726ad8134518522dec23c0947db379dbb613cfb1c4141771c28ea2c7c4cdbe9966d19bb1d30e16ad32821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ba95.TMP

Filesize
371B

MD5
e28eff43f8497394912eec7862becf2d

SHA1
07858f11ddf9547c64a17f18f33f07b810914a1f

SHA256
35b4969517d1762805c55f11e8e60f8fe489c1768391aad996bb4bd0d3edcee9

SHA512
e1b341f43c54128ae05dc1fa7595b5385011514fd0dd21e3a9a101cc7e7bc0b8080edefedff5e6b82f3c2133b1ff071e72d2c9675b2f3435ecef48a6204baf0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b2d33575183c1bc0b2adc4288d3160cc

SHA1
f4b35c08e98483a2885d241ed49f4ee75474d10f

SHA256
26c4c648af9bdb6f35b71b09ae476dbfc1eae53b258ea78822b058645b013e6d

SHA512
fdc57ff1a22d7c54f7cd2cffa829934c8ba045ea4f7e9aeaa7e29b3223d8c0d93d202b7902b58d89f71c0b1a6b5a5967030eea473a2eb47009b116e2ca303ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\svhost.exe

Filesize
1.6MB

MD5
1c9ff7df71493896054a91bee0322ebf

SHA1
38f1c85965d58b910d8e8381b6b1099d5dfcbfe4

SHA256
e8b5da3394bbdd7868122ffd88d9d06afe31bd69d656857910d2f820c32d0efa

SHA512
aa0def62b663743e6c3c022182b35cff33cb9abf08453d5098f3c5d32b2a8b0cd1cc5de64b93e39680c1d1396fef1fd50b642ca3ea4ba1f6d1078321d96916ab

Download Submit
\??\pipe\LOCAL\crashpad_552_EXBNMKCAOKMNAZUA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/432-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1796-72-0x0000000075090000-0x0000000075641000-memory.dmp

Filesize
5.7MB

Download
memory/1796-0-0x0000000075092000-0x0000000075093000-memory.dmp

Filesize
4KB

Download
memory/1796-2-0x0000000075090000-0x0000000075641000-memory.dmp

Filesize
5.7MB

Download
memory/1796-1-0x0000000075090000-0x0000000075641000-memory.dmp

Filesize
5.7MB

Download