mystic | 3bad5318d1eadf9f6d544fc5ed49c1e737fb2db130f60b70bab6f26392c87c30

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99144a8cae61109b46016ef756589ba3aa71222da541e3bda432b738f7469d06.exe
Size

1.3MB
MD5

904fc61b1f44c5223a3c954b4cc2752d
SHA1

fff176e87a9300b428235e8c991fc4620002e646
SHA256

99144a8cae61109b46016ef756589ba3aa71222da541e3bda432b738f7469d06
SHA512

dc2eca434302c7988352395784452acf238aa57c440e789e8d507a695a10856aa36cbd2fdbd72854862b30350c8150c02e7e807ea6f2f76b18be46a376dd8749
SSDEEP

24576:0yzM9afmu263sRRmqwwLa5kbuI1T6CYDjJWjCCJIEFcOrrG4KRNy:DGHM8RRm55kiIgCEkj2EFcOfGX

Score

10^/10

mystic redline smokeloader breha backdoor infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 1 IoCs

resource	yara_rule
behavioral14/files/0x0007000000023473-34.dat	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral14/memory/2216-43-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral14/memory/1844-28-0x0000000002360000-0x0000000002380000-memory.dmp	net_reactor
behavioral14/memory/1844-30-0x0000000002420000-0x000000000243E000-memory.dmp	net_reactor

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	5Gh8ZM5.exe

Executes dropped EXE 8 IoCs

pid	Process
4980	ew2BQ99.exe
2156	Kv6Yi22.exe
1260	jx1Hk06.exe
1844	1nl37Dh6.exe
2856	2lk3175.exe
5116	3lf82vk.exe
5036	4yF927ZQ.exe
3012	5Gh8ZM5.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	99144a8cae61109b46016ef756589ba3aa71222da541e3bda432b738f7469d06.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ew2BQ99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Kv6Yi22.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	jx1Hk06.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5116 set thread context of 3400	5116	3lf82vk.exe	100
PID 5036 set thread context of 2216	5036	4yF927ZQ.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
3588	msedge.exe
3588	msedge.exe
2196	msedge.exe
2196	msedge.exe
2092	identity_helper.exe
2092	identity_helper.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	1nl37Dh6.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 4980	3488	99144a8cae61109b46016ef756589ba3aa71222da541e3bda432b738f7469d06.exe	85
PID 3488 wrote to memory of 4980	3488	99144a8cae61109b46016ef756589ba3aa71222da541e3bda432b738f7469d06.exe	85
PID 3488 wrote to memory of 4980	3488	99144a8cae61109b46016ef756589ba3aa71222da541e3bda432b738f7469d06.exe	85
PID 4980 wrote to memory of 2156	4980	ew2BQ99.exe	86
PID 4980 wrote to memory of 2156	4980	ew2BQ99.exe	86
PID 4980 wrote to memory of 2156	4980	ew2BQ99.exe	86
PID 2156 wrote to memory of 1260	2156	Kv6Yi22.exe	88
PID 2156 wrote to memory of 1260	2156	Kv6Yi22.exe	88
PID 2156 wrote to memory of 1260	2156	Kv6Yi22.exe	88
PID 1260 wrote to memory of 1844	1260	jx1Hk06.exe	89
PID 1260 wrote to memory of 1844	1260	jx1Hk06.exe	89
PID 1260 wrote to memory of 1844	1260	jx1Hk06.exe	89
PID 1260 wrote to memory of 2856	1260	jx1Hk06.exe	97
PID 1260 wrote to memory of 2856	1260	jx1Hk06.exe	97
PID 1260 wrote to memory of 2856	1260	jx1Hk06.exe	97
PID 2156 wrote to memory of 5116	2156	Kv6Yi22.exe	98
PID 2156 wrote to memory of 5116	2156	Kv6Yi22.exe	98
PID 2156 wrote to memory of 5116	2156	Kv6Yi22.exe	98
PID 5116 wrote to memory of 3400	5116	3lf82vk.exe	100
PID 5116 wrote to memory of 3400	5116	3lf82vk.exe	100
PID 5116 wrote to memory of 3400	5116	3lf82vk.exe	100
PID 5116 wrote to memory of 3400	5116	3lf82vk.exe	100
PID 5116 wrote to memory of 3400	5116	3lf82vk.exe	100
PID 5116 wrote to memory of 3400	5116	3lf82vk.exe	100
PID 4980 wrote to memory of 5036	4980	ew2BQ99.exe	101
PID 4980 wrote to memory of 5036	4980	ew2BQ99.exe	101
PID 4980 wrote to memory of 5036	4980	ew2BQ99.exe	101
PID 5036 wrote to memory of 2708	5036	4yF927ZQ.exe	106
PID 5036 wrote to memory of 2708	5036	4yF927ZQ.exe	106
PID 5036 wrote to memory of 2708	5036	4yF927ZQ.exe	106
PID 5036 wrote to memory of 2216	5036	4yF927ZQ.exe	107
PID 5036 wrote to memory of 2216	5036	4yF927ZQ.exe	107
PID 5036 wrote to memory of 2216	5036	4yF927ZQ.exe	107
PID 5036 wrote to memory of 2216	5036	4yF927ZQ.exe	107
PID 5036 wrote to memory of 2216	5036	4yF927ZQ.exe	107
PID 5036 wrote to memory of 2216	5036	4yF927ZQ.exe	107
PID 5036 wrote to memory of 2216	5036	4yF927ZQ.exe	107
PID 5036 wrote to memory of 2216	5036	4yF927ZQ.exe	107
PID 3488 wrote to memory of 3012	3488	99144a8cae61109b46016ef756589ba3aa71222da541e3bda432b738f7469d06.exe	108
PID 3488 wrote to memory of 3012	3488	99144a8cae61109b46016ef756589ba3aa71222da541e3bda432b738f7469d06.exe	108
PID 3488 wrote to memory of 3012	3488	99144a8cae61109b46016ef756589ba3aa71222da541e3bda432b738f7469d06.exe	108
PID 3012 wrote to memory of 672	3012	5Gh8ZM5.exe	109
PID 3012 wrote to memory of 672	3012	5Gh8ZM5.exe	109
PID 672 wrote to memory of 2000	672	cmd.exe	112
PID 672 wrote to memory of 2000	672	cmd.exe	112
PID 672 wrote to memory of 2196	672	cmd.exe	114
PID 672 wrote to memory of 2196	672	cmd.exe	114
PID 2000 wrote to memory of 4116	2000	msedge.exe	113
PID 2000 wrote to memory of 4116	2000	msedge.exe	113
PID 2196 wrote to memory of 2168	2196	msedge.exe	115
PID 2196 wrote to memory of 2168	2196	msedge.exe	115
PID 2000 wrote to memory of 2916	2000	msedge.exe	116
PID 2000 wrote to memory of 2916	2000	msedge.exe	116
PID 2000 wrote to memory of 2916	2000	msedge.exe	116
PID 2000 wrote to memory of 2916	2000	msedge.exe	116
PID 2000 wrote to memory of 2916	2000	msedge.exe	116
PID 2000 wrote to memory of 2916	2000	msedge.exe	116
PID 2000 wrote to memory of 2916	2000	msedge.exe	116
PID 2000 wrote to memory of 2916	2000	msedge.exe	116
PID 2000 wrote to memory of 2916	2000	msedge.exe	116
PID 2000 wrote to memory of 2916	2000	msedge.exe	116
PID 2000 wrote to memory of 2916	2000	msedge.exe	116
PID 2000 wrote to memory of 2916	2000	msedge.exe	116
PID 2000 wrote to memory of 2916	2000	msedge.exe	116

C:\Users\Admin\AppData\Local\Temp\99144a8cae61109b46016ef756589ba3aa71222da541e3bda432b738f7469d06.exe
"C:\Users\Admin\AppData\Local\Temp\99144a8cae61109b46016ef756589ba3aa71222da541e3bda432b738f7469d06.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ew2BQ99.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ew2BQ99.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Kv6Yi22.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Kv6Yi22.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jx1Hk06.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jx1Hk06.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1nl37Dh6.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1nl37Dh6.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2lk3175.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2lk3175.exe
        5⤵
        Executes dropped EXE
        
        PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3lf82vk.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3lf82vk.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:5116
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        
        PID:3400
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4yF927ZQ.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4yF927ZQ.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2708
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2216
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Gh8ZM5.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Gh8ZM5.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A6FE.tmp\A6FF.tmp\A700.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Gh8ZM5.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffe4a5046f8,0x7ffe4a504708,0x7ffe4a504718
        5⤵
        
        PID:4116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,8727814543307830120,1519421583215793809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
        5⤵
        
        PID:2916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,8727814543307830120,1519421583215793809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe4a5046f8,0x7ffe4a504708,0x7ffe4a504718
        5⤵
        
        PID:2168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2966765112740256426,15113198906908452901,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
        5⤵
        
        PID:3916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,2966765112740256426,15113198906908452901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,2966765112740256426,15113198906908452901,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
        5⤵
        
        PID:4100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2966765112740256426,15113198906908452901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        
        PID:4720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2966765112740256426,15113198906908452901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
        5⤵
        
        PID:4828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2966765112740256426,15113198906908452901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
        5⤵
        
        PID:4384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2966765112740256426,15113198906908452901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
        5⤵
        
        PID:2472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2966765112740256426,15113198906908452901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2966765112740256426,15113198906908452901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=164 /prefetch:1
        5⤵
        
        PID:3612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2966765112740256426,15113198906908452901,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
        5⤵
        
        PID:5080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2966765112740256426,15113198906908452901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
        5⤵
        
        PID:1552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2966765112740256426,15113198906908452901,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
        5⤵
        
        PID:1608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2966765112740256426,15113198906908452901,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4544 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b8d9dfebaac964080b30406a0d488d36

SHA1
10ebe143171e19574a4a749ffea7d641dfdd5be0

SHA256
1c2fc849b664fb70db2a56e85cce2a7a2e47ee4018f1014bb378c0a1343810d1

SHA512
663b01466bbc103a8811f4dbd87ebe9c18f02bf1b7749cc65a1d7c31d05b34d01d6a23c495d8a0fdf40eea7443a700c3e1fbf00a30ae144073dab1b7377e5a48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6a64601e785a304bcf4d5ada51a0b429

SHA1
7dce23e3d6b4a0f756f48861c5cd64f690a8236d

SHA256
fed2d5033c049d0d92b92d1ae2401faf1bfd41afddf3e869bde15eef9cab0fc4

SHA512
fa41ba9711f7e41172e4a37802b91ac735cfcb615a5222408b49554001eb55cb07c65f1ee7b3e28b4fcc701b1611a36393e70c23fc1d7afee8dd76123026611a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
adec9614cf05e5ef96d0a6032c52be86

SHA1
c46456520dd5bf84ea20153061297b54fd4178c0

SHA256
262348c3a4cae5dbf179baf85691e9f1e786941ca2a26ec8e9c7f3a7edaddba1

SHA512
89ae9490ea0bb3ec4df2b64587f7d5d6497ae5dbc70f1c71cb76c8fe20ed9d364787674ac8eb013123eb9a68e52f4eb723f10df1afa175d887bd6ee1f83c968a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cdac488d0c6e00c3685b56ede899dd97

SHA1
93979dd2929ff87401f8b11567294b5174e4b390

SHA256
a747b92a1946ed17695f38d3ef60e51d9631ad835cdb2bc292deeaeb88fa1334

SHA512
29fc026bfcda323bad326c86b4f005b90abe3def7d3fcaa9a9427a6d0e4955a5f26fbd39a354da313f475e779047680cc3ed20826496ab55e1b7e7b2ba6581d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
127f773deeedbf14f14b0e389d55a74b

SHA1
23936b2a66b6c07b9a1b567f2a6ac99105fee7d7

SHA256
cac10c1475efa4a0a8e4797a2dd9b21467fccdb0df9ae549c063ce6df41e0786

SHA512
5ea7cbf866c2295de6a349a60279c49851486f8c0b381297c601410ff0ddb8c1abe3b262bfecb41efc957161e2870eae6aee40e859bb0f387418afae37319472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
49e5ca12c2032b7d948402ab1697f8a8

SHA1
b23f78976464d29a69905778e474ad2c79d68975

SHA256
f5d4509d4d48fefbf7ec027a036cb38d9566ca4bb1c58feec4d34bc66cd06c62

SHA512
52a10a5ac000207edbb805cd0a7d1e4f0383b062e1bfacca89f5e31bdfb18ecf796fb70c78b484b361fddad2b468c3e37143e3452af575e5b8f4c685e9ea2ec3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
6ff6ace4d80755ede7572dffa47dc3ee

SHA1
f4b6f6d6749662045f35559eb1dfe9f3ea429962

SHA256
11b6fa898db57ef5d440b840a317bc342d3080ee3f1b3941aa7721059ffdb834

SHA512
28002dab49d991525a86629ac736694d23a91b77cb171271f21b87a955713106e89851a3d239c130639e08f0425019520ecce209f900427181a83cb28472e44a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58557e.TMP

Filesize
872B

MD5
27c780bebb35fb96e63a315d48ece58d

SHA1
acaf2c6a3e9f3760fab6aea773fdc8f72a1c9be3

SHA256
fd75f343fce5f3cfea06b91385c290fc87e56a597b2c03b5210c5476aaf57678

SHA512
5b55b786567e87db1b679d0e31f0f0ecd7b6c8a5acc9c6fa831c6bc88b16ab04e71cedfa9128c4ed75a54eccbf73451d7092b1c17c4f161395e9c7fcaf30a08b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
be4b1271392137a4b7ebd1267d34fb9b

SHA1
6bc17c153d3d0277aa8f223303f311e9b048a289

SHA256
ae5db93923c3e3f05930dd508b71f3a67646dfae75cf522632058f3805599c7a

SHA512
105b1bda613e161cddaf5b1df48787a16cdf7386e047baaef8296c4c79e5f9340df1f62462fa6eca991b2cec304308e2e3bca0052713f8cd63d2d9d5c8aacd7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
05b7360605574b5d44c0e224a182079f

SHA1
9fc78a4871de5a98ee450b0f76b0392f0b09fd21

SHA256
17fb34aebb6d47e949a72c1860c7d1551b165e2bd959e655ac10f7fa67039e8a

SHA512
d474194976a5de4c3fe8a75b0c32e870321be8acb801da87dc2413e5592c047cdadaa13547ec387f1a2b009dfa0347d502dbf8e4af08bbc96be126423217228e

Download Submit
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp\A6FF.tmp\A700.bat

Filesize
88B

MD5
0ec04fde104330459c151848382806e8

SHA1
3b0b78d467f2db035a03e378f7b3a3823fa3d156

SHA256
1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f

SHA512
8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Gh8ZM5.exe

Filesize
99KB

MD5
0c8081c2428d09e139a21415b9038643

SHA1
fdd471c6f045573cdd0e79a98c3b6d7cf3dec6df

SHA256
e344215bb8cbd42621e02e9c412191ccd6545a472533d09d35df6c39f376857c

SHA512
ad7d207957c5623a99e10d3cbaddb46bd558eec3cc1449ccb46fbdb4d32c21084d577e24fa84c31e926a1ff349d70e342369593178e507bb005293dd4d1ac0d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ew2BQ99.exe

Filesize
1.2MB

MD5
779aef1c8bad571201cf1c370d4ee94f

SHA1
df31402f87823e815134b943c6bed6e35c4724bb

SHA256
f8755521afb81da75bda617ffb9f343494c81448ac234af0939938c80bf5c261

SHA512
51d8b01ee21a51282dbc3514457d1a829475dee81fddd2e325f1671cbce2f08ff4268163262671d2c900870c9cdf82cee5a47def9042ba5ec0bc7f40a6b841b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4yF927ZQ.exe

Filesize
1.2MB

MD5
267ef1a960bfb0bb33928ec219dc1cea

SHA1
fc28acaa6e4e4af3ad7fc8c2a851e84419a2eebf

SHA256
b462fedfb5904509e82387e2591bdb1ddfe6d12b6a28a189c6403a860050965e

SHA512
ba09e6c6b71426e09214c1c6773114d0a46edd133d711f81960390f940a81a695550971b30c1d292109873b524db94b596ecaebfaf379e6c6bcfd4089379e38f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Kv6Yi22.exe

Filesize
747KB

MD5
2cfc60abe59ad55a40452109498748b1

SHA1
9b9f79eec2fc6de056c9f91d5f648e801604dc9c

SHA256
5db09d00b51314fb37b7339b5e17ba602bd00446bc20938e462e23af64572e04

SHA512
15359dd52a487452ea11389fe7de2237ae201529039d3c5dee48cf4bedd0d126b261f76fef28a1c6dfa529281bcda8d42c43c0a2801e3f9270e274d89b594308

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3lf82vk.exe

Filesize
973KB

MD5
5dc4be46727c1853e63ebdd240ec9bd9

SHA1
6265b41bbecbb96cf666d2b4cbd6f209f44d7a2d

SHA256
1df63e2de3adac7ff425c75b3f649078fd7a8e0008e5063bd290adb1cdba2446

SHA512
59828cba7af9fb26c6717eb3e655eec07f732ec92d3ec0cce7ed2df1acf6095dec2d97cdbbd3591ed96c08cb2adcff12c31534a93b48757ff8976c0a4233062b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jx1Hk06.exe

Filesize
364KB

MD5
28ab3d711ccaf4d124d3d2cdf8b38b07

SHA1
93293ef8c04650a5e27c13e58428f7bb66b5c1e6

SHA256
b0f0a8a11d4cd24c580a04fc59fbc0e8b564492dcc473cd08d89f540d87784d2

SHA512
0966aa948999c1b5f79388677473f1d67d669e1ebcfc4bc3f572b4e8e11439f94398ff5112eeb59553530847e9b59f12c3592c3ccf832d7b7a6351881f40b19f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1nl37Dh6.exe

Filesize
188KB

MD5
425e2a994509280a8c1e2812dfaad929

SHA1
4d5eff2fb3835b761e2516a873b537cbaacea1fe

SHA256
6f40f29ad16466785dfbe836dd375400949ff894e8aa03e2805ab1c1ac2d6f5a

SHA512
080a41e7926122e14b38901f2e1eb8100a08c5068a9a74099f060c5e601f056a66e607b4e006820276834bb01d913a3894de98e6d9ba62ce843df14058483aa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2lk3175.exe

Filesize
186KB

MD5
3a24a41f3044d90555f6cdea0f2533f8

SHA1
25a1913e9e41dd13039d023a5f63a050256c72ca

SHA256
5e900b7d563b6dc3f5c5db7386ae7ea83ec512b1a72a1cac6d16d17110a90253

SHA512
8d12aca702a3f81329fe0dad30b28269fd9933b5493e8d978080fbee9b66a1727b76b6230d910a9cda1ca68141b55ef7b63fd3f7de077eb453da7d8b44f5b837

Download Submit
memory/1844-31-0x0000000004BB0000-0x0000000004C42000-memory.dmp

Filesize
584KB

Download
memory/1844-28-0x0000000002360000-0x0000000002380000-memory.dmp

Filesize
128KB

Download
memory/1844-29-0x0000000004CB0000-0x0000000005254000-memory.dmp

Filesize
5.6MB

Download
memory/1844-30-0x0000000002420000-0x000000000243E000-memory.dmp

Filesize
120KB

Download
memory/2216-52-0x0000000007F60000-0x0000000007F72000-memory.dmp

Filesize
72KB

Download
memory/2216-48-0x0000000007E80000-0x0000000007E8A000-memory.dmp

Filesize
40KB

Download
memory/2216-43-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2216-50-0x0000000008D70000-0x0000000009388000-memory.dmp

Filesize
6.1MB

Download
memory/2216-51-0x0000000008030000-0x000000000813A000-memory.dmp

Filesize
1.0MB

Download
memory/2216-53-0x0000000007FC0000-0x0000000007FFC000-memory.dmp

Filesize
240KB

Download
memory/2216-54-0x0000000008140000-0x000000000818C000-memory.dmp

Filesize
304KB

Download
memory/3400-39-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download