mystic | 4b8426608d129065454fb59979cb7863e9b221d10a94bf05a1dddf8807d50656

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56d014c086bdbb8e6727c4aa360408eb457604ca6d788375c3e76d1fc1282a70.exe
Size

1.1MB
MD5

390faea7dece9ed80b3699b6223e8fd5
SHA1

a1e00a7cc23aacddeab3203a987ec37f645b80ac
SHA256

56d014c086bdbb8e6727c4aa360408eb457604ca6d788375c3e76d1fc1282a70
SHA512

c9d4674c9bfcf72a7616cc30c01de867b405ba46f0ff72217920fbb0e243da52a97d7c0f483c23fa96a213addbd1a84bfcd2c5ead960b23668a20a9c5e20f928
SSDEEP

24576:LyjTfPGEMBaeOharfPsvaRxbFFZ47NGqKN3/mJ7a/sv:+jTHGEDeT3T/ZetKZE7a/

Score

10^/10

mystic redline smokeloader magia backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

magia

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral8/memory/644-63-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral8/memory/644-66-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral8/memory/644-64-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1Dj64RS4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1Dj64RS4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1Dj64RS4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	1Dj64RS4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1Dj64RS4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1Dj64RS4.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral8/memory/780-74-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	5Ae4ON6.exe

Executes dropped EXE 8 IoCs

pid	Process
4616	My3xt57.exe
2996	Jz0Vb45.exe
2328	hj1wP54.exe
2180	1Dj64RS4.exe
1524	2Yy7755.exe
3080	3uw01Fq.exe
436	4nB010nc.exe
3740	5Ae4ON6.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	1Dj64RS4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1Dj64RS4.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	56d014c086bdbb8e6727c4aa360408eb457604ca6d788375c3e76d1fc1282a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	My3xt57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Jz0Vb45.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	hj1wP54.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1524 set thread context of 644	1524	2Yy7755.exe	110
PID 3080 set thread context of 3924	3080	3uw01Fq.exe	115
PID 436 set thread context of 780	436	4nB010nc.exe	123

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2388	1524	WerFault.exe	108
1784	3080	WerFault.exe	114
3456	436	WerFault.exe	120

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1181767204-2009306918-3718769404-1000\{4A906E73-B317-4F40-9B16-5FDA1D75F594}	msedge.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2180	1Dj64RS4.exe
2180	1Dj64RS4.exe
2180	1Dj64RS4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	1Dj64RS4.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 4616	744	56d014c086bdbb8e6727c4aa360408eb457604ca6d788375c3e76d1fc1282a70.exe	91
PID 744 wrote to memory of 4616	744	56d014c086bdbb8e6727c4aa360408eb457604ca6d788375c3e76d1fc1282a70.exe	91
PID 744 wrote to memory of 4616	744	56d014c086bdbb8e6727c4aa360408eb457604ca6d788375c3e76d1fc1282a70.exe	91
PID 4616 wrote to memory of 2996	4616	My3xt57.exe	92
PID 4616 wrote to memory of 2996	4616	My3xt57.exe	92
PID 4616 wrote to memory of 2996	4616	My3xt57.exe	92
PID 2996 wrote to memory of 2328	2996	Jz0Vb45.exe	93
PID 2996 wrote to memory of 2328	2996	Jz0Vb45.exe	93
PID 2996 wrote to memory of 2328	2996	Jz0Vb45.exe	93
PID 2328 wrote to memory of 2180	2328	hj1wP54.exe	94
PID 2328 wrote to memory of 2180	2328	hj1wP54.exe	94
PID 2328 wrote to memory of 2180	2328	hj1wP54.exe	94
PID 2328 wrote to memory of 1524	2328	hj1wP54.exe	108
PID 2328 wrote to memory of 1524	2328	hj1wP54.exe	108
PID 2328 wrote to memory of 1524	2328	hj1wP54.exe	108
PID 1524 wrote to memory of 896	1524	2Yy7755.exe	109
PID 1524 wrote to memory of 896	1524	2Yy7755.exe	109
PID 1524 wrote to memory of 896	1524	2Yy7755.exe	109
PID 1524 wrote to memory of 644	1524	2Yy7755.exe	110
PID 1524 wrote to memory of 644	1524	2Yy7755.exe	110
PID 1524 wrote to memory of 644	1524	2Yy7755.exe	110
PID 1524 wrote to memory of 644	1524	2Yy7755.exe	110
PID 1524 wrote to memory of 644	1524	2Yy7755.exe	110
PID 1524 wrote to memory of 644	1524	2Yy7755.exe	110
PID 1524 wrote to memory of 644	1524	2Yy7755.exe	110
PID 1524 wrote to memory of 644	1524	2Yy7755.exe	110
PID 1524 wrote to memory of 644	1524	2Yy7755.exe	110
PID 1524 wrote to memory of 644	1524	2Yy7755.exe	110
PID 2996 wrote to memory of 3080	2996	Jz0Vb45.exe	114
PID 2996 wrote to memory of 3080	2996	Jz0Vb45.exe	114
PID 2996 wrote to memory of 3080	2996	Jz0Vb45.exe	114
PID 3080 wrote to memory of 3924	3080	3uw01Fq.exe	115
PID 3080 wrote to memory of 3924	3080	3uw01Fq.exe	115
PID 3080 wrote to memory of 3924	3080	3uw01Fq.exe	115
PID 3080 wrote to memory of 3924	3080	3uw01Fq.exe	115
PID 3080 wrote to memory of 3924	3080	3uw01Fq.exe	115
PID 3080 wrote to memory of 3924	3080	3uw01Fq.exe	115
PID 4616 wrote to memory of 436	4616	My3xt57.exe	120
PID 4616 wrote to memory of 436	4616	My3xt57.exe	120
PID 4616 wrote to memory of 436	4616	My3xt57.exe	120
PID 436 wrote to memory of 3512	436	4nB010nc.exe	121
PID 436 wrote to memory of 3512	436	4nB010nc.exe	121
PID 436 wrote to memory of 3512	436	4nB010nc.exe	121
PID 436 wrote to memory of 1444	436	4nB010nc.exe	122
PID 436 wrote to memory of 1444	436	4nB010nc.exe	122
PID 436 wrote to memory of 1444	436	4nB010nc.exe	122
PID 436 wrote to memory of 780	436	4nB010nc.exe	123
PID 436 wrote to memory of 780	436	4nB010nc.exe	123
PID 436 wrote to memory of 780	436	4nB010nc.exe	123
PID 436 wrote to memory of 780	436	4nB010nc.exe	123
PID 436 wrote to memory of 780	436	4nB010nc.exe	123
PID 436 wrote to memory of 780	436	4nB010nc.exe	123
PID 436 wrote to memory of 780	436	4nB010nc.exe	123
PID 436 wrote to memory of 780	436	4nB010nc.exe	123
PID 744 wrote to memory of 3740	744	56d014c086bdbb8e6727c4aa360408eb457604ca6d788375c3e76d1fc1282a70.exe	126
PID 744 wrote to memory of 3740	744	56d014c086bdbb8e6727c4aa360408eb457604ca6d788375c3e76d1fc1282a70.exe	126
PID 744 wrote to memory of 3740	744	56d014c086bdbb8e6727c4aa360408eb457604ca6d788375c3e76d1fc1282a70.exe	126
PID 3740 wrote to memory of 2620	3740	5Ae4ON6.exe	127
PID 3740 wrote to memory of 2620	3740	5Ae4ON6.exe	127
PID 2620 wrote to memory of 4332	2620	cmd.exe	130
PID 2620 wrote to memory of 4332	2620	cmd.exe	130
PID 2620 wrote to memory of 2280	2620	cmd.exe	138
PID 2620 wrote to memory of 2280	2620	cmd.exe	138

C:\Users\Admin\AppData\Local\Temp\56d014c086bdbb8e6727c4aa360408eb457604ca6d788375c3e76d1fc1282a70.exe
"C:\Users\Admin\AppData\Local\Temp\56d014c086bdbb8e6727c4aa360408eb457604ca6d788375c3e76d1fc1282a70.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:744
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\My3xt57.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\My3xt57.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Jz0Vb45.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Jz0Vb45.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hj1wP54.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hj1wP54.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Dj64RS4.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Dj64RS4.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yy7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yy7755.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1524
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:896
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:644
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 608
        6⤵
        Program crash
        
        PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3uw01Fq.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3uw01Fq.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3080
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        
        PID:3924
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 572
        5⤵
        Program crash
        
        PID:1784
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4nB010nc.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4nB010nc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:3512
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:1444
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 612
      4⤵
      Program crash
      PID:3456
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Ae4ON6.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Ae4ON6.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\40DC.tmp\40DD.tmp\40DE.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Ae4ON6.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4276,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:8
1⤵
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1524 -ip 1524
1⤵
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3080 -ip 3080
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 436 -ip 436
1⤵
PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=4820,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
1⤵
PID:1216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4912,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
1⤵
PID:3156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=5012,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
1⤵
PID:2444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5564,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
1⤵
PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5616,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
1⤵
PID:2388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6012,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=6176,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
1⤵
PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=6572,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
1⤵
PID:1184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5928,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
1⤵
PID:3096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5124,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
1⤵
- Modifies registry class
PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=5604,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
1⤵
PID:5668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\40DC.tmp\40DD.tmp\40DE.bat

Filesize
88B

MD5
0ec04fde104330459c151848382806e8

SHA1
3b0b78d467f2db035a03e378f7b3a3823fa3d156

SHA256
1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f

SHA512
8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Ae4ON6.exe

Filesize
97KB

MD5
09a0c9c67a668f95005d80047b1151c2

SHA1
d77e6e74b61b379b2c23421bf07dddc3a54e902a

SHA256
8737837e29992a01c68afc6ce6f2ba8a0f301d8cbe084b8e3a72a1a7820ec57c

SHA512
46c315c219b76b8b9aa4f5faad552eecf2b6f998b0c3c787029736f3ff66ac75127c0752ecc9f12bef97125f29e12406c0cecdaf28386813dbe4cc37e38137e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\My3xt57.exe

Filesize
1018KB

MD5
77dbedc62a7d1fa49469e095ef9ab1fd

SHA1
03482037a34640319f338eff78f1a6fa0b20e1cd

SHA256
8ed95765f9964a1d8ef124463805eeabd2cca82e05230a4b27f5905897e3c415

SHA512
35b567cdc3ce2003b3f431e6166fca42933d9469861e03da29b7041e714b649f25592ba3772a9908208e8dee994d1cc13365251a980184a240677dc993a7fd4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4nB010nc.exe

Filesize
461KB

MD5
23e08358a6a84ce052d2ec882648cd28

SHA1
ed08af4489d9939c740e4a05f320b513d3a9291c

SHA256
09aa8bb7d372a6efaf64f43e794e9ead16ed0c24d3e2991c6b0305eab0fbb1b1

SHA512
f62ee5cf542356436204d1160e858857d074c2e5e9846573c6b662a17ddf2316fecbf68f86183d2ee5889cd8914f69fa6512e8209cd989aa45a9e9f8756dba73

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Jz0Vb45.exe

Filesize
723KB

MD5
8aa984c87f621f873df7aaa6994a50d5

SHA1
4e5209f9e490323925f8f4f00caef2f0b38832a8

SHA256
0e619958adaec4ade50fc2833c150126779e923c4c4e2fdd6489e18fa8dc3821

SHA512
e50d3978e0eb7011d7d02d81bed2c995088a93fe30ac5ccf6ed3423441de2d15be830c1e37b0b577f219ca6429bde7cf5aa4e7a8a04d6ecd165ce1eb39b63108

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3uw01Fq.exe

Filesize
270KB

MD5
b5fd67f4c5030b8ee19789a6dc346f8d

SHA1
007088144b57edb928972c6a9a1ed9ffae465335

SHA256
d986c54ef77cea2350bc755f4aadd218f26e49e0ac253922e8995df01fcef02d

SHA512
96c5803953a6124e17b5557f84866857ac22ac7306aa23a5cf89e9e769c1791e0464dd0a7489c6e781359ed5b0a95e1b81c16ae70a63a676cc53c6b21df4687d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hj1wP54.exe

Filesize
478KB

MD5
05d1080c3a5c66d98fe790c86867386d

SHA1
2795052a3c782d4a07a5a46668069f6f9d345f6b

SHA256
11e16a3df4fca6af0c81ec959c325dbcad38efb083584fb7fa752def70d4f4e9

SHA512
cf7cba9891543576474fe939625289fbc8b11e9fb21ba8a6398399eab73bf8c59a56a0705738fab4a7b0cdf95df93576feae0a3f858cf1a1d5d0e16530aae368

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Dj64RS4.exe

Filesize
194KB

MD5
6241b03d68a610324ecda52f0f84e287

SHA1
da80280b6e3925e455925efd6c6e59a6118269c4

SHA256
ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

SHA512
a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yy7755.exe

Filesize
422KB

MD5
c8f28eafb5293f95b95e76d8d95e2a25

SHA1
5d1fb47251923d7105a9f996069ac20e28d20d43

SHA256
778c3435847e4b9d070bb1d542190b3129d5c6ff568aa985686405be6874c480

SHA512
72c6ae6ddf763ee9c6f494ea5ba5ef493b21ee7899005ade66b8917ad4a3135671582d8325cb5958cabc07fd5a88cd65b9765686e769121b058920fd0a9ee856

Download Submit
memory/644-63-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/644-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/644-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/780-81-0x00000000088E0000-0x0000000008EF8000-memory.dmp

Filesize
6.1MB

Download
memory/780-74-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/780-75-0x0000000007860000-0x00000000078F2000-memory.dmp

Filesize
584KB

Download
memory/780-76-0x0000000004C70000-0x0000000004C7A000-memory.dmp

Filesize
40KB

Download
memory/780-85-0x0000000007A80000-0x0000000007ACC000-memory.dmp

Filesize
304KB

Download
memory/780-84-0x0000000007AF0000-0x0000000007B2C000-memory.dmp

Filesize
240KB

Download
memory/780-82-0x0000000007C00000-0x0000000007D0A000-memory.dmp

Filesize
1.0MB

Download
memory/780-83-0x0000000007A40000-0x0000000007A52000-memory.dmp

Filesize
72KB

Download
memory/2180-38-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/2180-37-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/2180-32-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/2180-34-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/2180-40-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/2180-44-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/2180-46-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/2180-28-0x0000000000800000-0x000000000081E000-memory.dmp

Filesize
120KB

Download
memory/2180-48-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/2180-31-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/2180-50-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/2180-52-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/2180-54-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/2180-56-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/2180-58-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/2180-42-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/2180-30-0x0000000002450000-0x000000000246C000-memory.dmp

Filesize
112KB

Download
memory/2180-29-0x0000000004C00000-0x00000000051A4000-memory.dmp

Filesize
5.6MB

Download
memory/3924-70-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download