metasploit | 40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f

Analysis

max time kernel
147s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
Size 1.8MB
Sample240528-2pn6jagg35
SHA256 40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f
MD5 2a6e124b92eb398f7d93996b388fcd4e
SHA1 1d29f7093ba8d3688e64e8f28cc810e245a6de53
SHA512 6865060b3b366b5c0cec287e68ff8dd619699fff625945cd4e35ca36efce8a7a41edd9430ac9f420bdd640698968bab3464d469a1959d5ed6cdc8b588f5009ec
SSDEEP 24576:/3vLRdVhZBK8NogWYO09LOGi9JbBodjwC/hR:/3d5ZQ1BxJ+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit backdoor discovery spyware stealer trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

1.15.12.73:4567

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\S:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\U:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\X:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\B:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\M:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\H:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\I:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\J:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\Z:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\E:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\G:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\O:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\P:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\R:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\V:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\W:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\Y:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\A:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\K:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\T:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\L:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
File opened (read-only)	\??\N:	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4392	msedge.exe
4392	msedge.exe
4080	identity_helper.exe
4080	identity_helper.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4400	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
Token: SeDebugPrivilege	4400	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
Token: SeDebugPrivilege	2576	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
Token: SeDebugPrivilege	2576	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 2576	4400	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe	83
PID 4400 wrote to memory of 2576	4400	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe	83
PID 4400 wrote to memory of 2576	4400	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe	83
PID 2576 wrote to memory of 4392	2576	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe	93
PID 2576 wrote to memory of 4392	2576	40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe	93
PID 4392 wrote to memory of 1740	4392	msedge.exe	94
PID 4392 wrote to memory of 1740	4392	msedge.exe	94
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 2416	4392	msedge.exe	95
PID 4392 wrote to memory of 4852	4392	msedge.exe	96
PID 4392 wrote to memory of 4852	4392	msedge.exe	96
PID 4392 wrote to memory of 4748	4392	msedge.exe	97
PID 4392 wrote to memory of 4748	4392	msedge.exe	97
PID 4392 wrote to memory of 4748	4392	msedge.exe	97
PID 4392 wrote to memory of 4748	4392	msedge.exe	97
PID 4392 wrote to memory of 4748	4392	msedge.exe	97
PID 4392 wrote to memory of 4748	4392	msedge.exe	97
PID 4392 wrote to memory of 4748	4392	msedge.exe	97
PID 4392 wrote to memory of 4748	4392	msedge.exe	97
PID 4392 wrote to memory of 4748	4392	msedge.exe	97
PID 4392 wrote to memory of 4748	4392	msedge.exe	97
PID 4392 wrote to memory of 4748	4392	msedge.exe	97
PID 4392 wrote to memory of 4748	4392	msedge.exe	97
PID 4392 wrote to memory of 4748	4392	msedge.exe	97
PID 4392 wrote to memory of 4748	4392	msedge.exe	97
PID 4392 wrote to memory of 4748	4392	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
"C:\Users\Admin\AppData\Local\Temp\40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Local\Temp\40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe
  "C:\Users\Admin\AppData\Local\Temp\40651e3f874b6ae3a26dfaa48dcc364b9233768c2520829e9e5932b6a5396d7f.exe" Admin
  2⤵
  - Drops file in Drivers directory
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa70ac46f8,0x7ffa70ac4708,0x7ffa70ac4718
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15248421240671457593,13017756346042671157,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,15248421240671457593,13017756346042671157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,15248421240671457593,13017756346042671157,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15248421240671457593,13017756346042671157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15248421240671457593,13017756346042671157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,15248421240671457593,13017756346042671157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,15248421240671457593,13017756346042671157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15248421240671457593,13017756346042671157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
      4⤵
      PID:508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15248421240671457593,13017756346042671157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15248421240671457593,13017756346042671157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15248421240671457593,13017756346042671157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15248421240671457593,13017756346042671157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15248421240671457593,13017756346042671157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15248421240671457593,13017756346042671157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15248421240671457593,13017756346042671157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15248421240671457593,13017756346042671157,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5960 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 cd26e465bb32f31c03b0f71ff89a9cc0f6e153c5c734f8290b463af0a9529d90
MD5 c764e6e54f13470545f4257cd0da9b35
SHA1 af4b80f14cbda9fc0aaacbb5ed046edb8ad8ba96
SHA512 58fe33bd64ef1822ee0a0d61b6b0ca3e103095c13130e246745ae4db3102694a5fb1136c2fe35280afa38b85bda36b3a2272799fdab5581b8e0b8f91556884ea
SSDEEP 96:n8kk41QPEj0wpvWMoiVmdeHmQIEiRUWQyV+VDCziEwb:n8kBGEj0GWMX6Rro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d15f261eb8aaf1c37368430413bae0c4954a2e38e0ead4399a84bfd9d07d802b
MD5 645db35b2ed96e36a2f9e6aa630a59f6
SHA1 843166ff7b2419c0e30379a8e872aec584a3dc69
SHA512 bbb0255f20fe86218ef2c33bab60032e83105bfe2d4db6eada1e46423251fcede8b46de0b92e8b6b842e22d789d3545c9305b3891585fd2d6400f929f8fdc187
SSDEEP 96:n8kv41QjEj0wpvWMoiVmdeHmQIEiRUWQyV+VD7AiEwb:n8kweEj0GWMX6Rrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7fb324a0087f5d097f63a8d68806220b43b64305b971966105d6ba9252cc1a93
MD5 2a7c2e0d472b4c6cc6ff087af05b1797
SHA1 a04c2ecd0c4dc27381fc6c883e9edddcc052a01b
SHA512 eedcf83405e959bc342eb8b0707e95e86c600432bb86ff662904f55e3a50d3f80b87f3d092b079a5fb13ee79fc329db943ecd97543b8cd59c8856c5591470617
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupvl8e2RUpIKbL1fYOxhZHnf:A9iIxuERzA83h09RZxYNiqLJxTHqTMT7
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 822B
SHA256 1bdd8f1dd7bd82b5b2313d8770dfe4f41cd3f45bbaeab8b8a7f75fc5e2d3720b
MD5 03450e8ddb20859f242195450c19b8f1
SHA1 9698f8caf67c8853e14c8bf4933949f458c3044a
SHA512 87371e57bf2296af5ec7f5db772a4ce66729d54aa23a8b384e3f4c42310b97b636576c7dff67c27a3b679339cdeee05b836563ae2a878f0367caf247b3e1ba7b
MD5 SHA1 SHA512

Submit Download

memory/2576-11-0x0000000000400000-0x00000000005E5000-memory.dmp

Download

memory/2576-9-0x0000000000400000-0x00000000005E5000-memory.dmp

Download

memory/2576-6-0x0000000002500000-0x0000000002501000-memory.dmp

Download

memory/4400-0-0x0000000000950000-0x0000000000951000-memory.dmp

Download

memory/4400-4-0x0000000000400000-0x00000000005E5000-memory.dmp

Download

memory/4400-2-0x00000000022D0000-0x00000000022D1000-memory.dmp

Download

memory/4400-1-0x0000000000950000-0x0000000000951000-memory.dmp

Download