risepro | 4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
Size 3.0MB
Sample240606-m68tyadc7v
SHA256 4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992
MD5 cfc861f4c0c38ac920d379f9d5976525
SHA1 a1090bec17bf6e9c9952044ab0336c19a237f153
SHA512 cfef9863cc9a8c5b1c8d719451b2029f6969bc33efaf6e2af27e2290ba7859365bb41240e027fe3d358f6b1228a9c7c318a078dc983392e320799a6336745814
SSDEEP 49152:TPWWRwiJvzUP9UwhKuUX9Kdssus4o1qtLi+MCM59yjyOfK3JAc4gvo2fqgXsu6jy:TuWRwi5g1bKvyvulo2i+MGRKZA4szJ4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro collection discovery persistence spyware stealer

Malware Config

Extracted

Family

risepro

147.45.47.126:58709

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS131.lnk	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe

Executes dropped EXE 1 IoCs

pid	Process
3932	NsGXQDPgMMo32peFzepQ.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131 = "C:\\Users\\Admin\\AppData\\Local\\RageMP131\\RageMP131.exe"	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdaterV131_30f85fd004d4df68ea1f8d35c18db496 = "C:\\Users\\Admin\\AppData\\Local\\AdobeUpdaterV131_30f85fd004d4df68ea1f8d35c18db496\\AdobeUpdaterV131.exe"	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
49	ipinfo.io
50	ipinfo.io

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000f000000023432-89.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3280	schtasks.exe
4324	schtasks.exe
2444	schtasks.exe
2672	schtasks.exe
3796	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3932	NsGXQDPgMMo32peFzepQ.exe
3932	NsGXQDPgMMo32peFzepQ.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3932	NsGXQDPgMMo32peFzepQ.exe
3932	NsGXQDPgMMo32peFzepQ.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 3280	1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe	95
PID 1220 wrote to memory of 3280	1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe	95
PID 1220 wrote to memory of 3280	1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe	95
PID 1220 wrote to memory of 4324	1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe	97
PID 1220 wrote to memory of 4324	1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe	97
PID 1220 wrote to memory of 4324	1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe	97
PID 1220 wrote to memory of 2444	1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe	112
PID 1220 wrote to memory of 2444	1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe	112
PID 1220 wrote to memory of 2444	1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe	112
PID 1220 wrote to memory of 2672	1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe	114
PID 1220 wrote to memory of 2672	1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe	114
PID 1220 wrote to memory of 2672	1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe	114
PID 1220 wrote to memory of 3932	1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe	116
PID 1220 wrote to memory of 3932	1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe	116
PID 1220 wrote to memory of 3932	1220	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe	116
PID 3932 wrote to memory of 4064	3932	NsGXQDPgMMo32peFzepQ.exe	117
PID 3932 wrote to memory of 4064	3932	NsGXQDPgMMo32peFzepQ.exe	117
PID 3932 wrote to memory of 4524	3932	NsGXQDPgMMo32peFzepQ.exe	119
PID 3932 wrote to memory of 4524	3932	NsGXQDPgMMo32peFzepQ.exe	119
PID 4064 wrote to memory of 2004	4064	msedge.exe	120
PID 4064 wrote to memory of 2004	4064	msedge.exe	120

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe

C:\Users\Admin\AppData\Local\Temp\4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe
"C:\Users\Admin\AppData\Local\Temp\4e9ba8ceb8e32d42999911cff209850fc3389bdc472e0b1853a9e3b41d3e5992.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1220
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:3280
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:4324
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_30f85fd004d4df68ea1f8d35c18db496\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_30f85fd004d4df68ea1f8d35c18db496 HR" /sc HOURLY /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:2444
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_30f85fd004d4df68ea1f8d35c18db496\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_30f85fd004d4df68ea1f8d35c18db496 LG" /sc ONLOGON /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\spanXaI7koEj6MXZ\NsGXQDPgMMo32peFzepQ.exe
  "C:\Users\Admin\AppData\Local\Temp\spanXaI7koEj6MXZ\NsGXQDPgMMo32peFzepQ.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe581446f8,0x7ffe58144708,0x7ffe58144718
      4⤵
      PID:2004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,10117673253740274891,3268065569606566631,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1956 /prefetch:2
      4⤵
      PID:3632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,10117673253740274891,3268065569606566631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
      4⤵
      PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
    3⤵
    PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe581446f8,0x7ffe58144708,0x7ffe58144718
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14609813707678614944,4359558473123950798,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
      4⤵
      PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,14609813707678614944,4359558473123950798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
      4⤵
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,14609813707678614944,4359558473123950798,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14609813707678614944,4359558473123950798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14609813707678614944,4359558473123950798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14609813707678614944,4359558473123950798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
      4⤵
      PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14609813707678614944,4359558473123950798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
      4⤵
      PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
    3⤵
    PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe581446f8,0x7ffe58144708,0x7ffe58144718
      4⤵
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6604867307248694566,4852292540211176464,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6604867307248694566,4852292540211176464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
      4⤵
      PID:624
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV131_f09ac2d587354c6431bf93812ba7548f\MSIUpdaterV131.exe" /tn "MSIUpdaterV131_f09ac2d587354c6431bf93812ba7548f HR" /sc HOURLY /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:3796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6776b4c1-0afc-4deb-a614-3ff9b741d214.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6776b4c1-0afc-4deb-a614-3ff9b741d214.tmp
Size 8KB
SHA256 e9fe8487878d3da0fff2c98b6199916e37bc59695958577874a7c0378dab6abf
MD5 887ad8992ae00122cd9e60c7eb314a0e
SHA1 0326c0c23747c371e06056aa7b76b39e5cdd1f54
SHA512 9e111a1166109e2073a5c5a354508600788f30575bb7ead1e8cf3c45c7a31385fcb78fc9814c1885a0c4e17dd8f019a27e1a7cc61b0a8b31a45a77e7dd15f014
SSDEEP 192:AoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiCre2RUinR4umh:49iIxuERzA83h09RZxYiGRRa
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 dc795176775b23bc71e1353844768534f154cee19ebdc8ff8ab95b5ceee03c83
MD5 f700c02a1702e66c59c3e977cd78f02b
SHA1 2913a15f59c4e28b731ff020b7ee0a1173c8b397
SHA512 387e1c22882d1ef5a14a7f7afdf11eac1429ab771265ed985f1ecb0039532b5fcf2ddeff44ec56058ee3dcfff81f868363b38d14166a8a76da514abe4e4a33f8
SSDEEP 96:nHckDXb1DEgjuwpvWMoiVmdeHvSSSMN6LE+UWQyV+VDCziEwb:nHck7bdEgjuGWMXEMNKE+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ca811d05e341a61f4c05355b4765ad2a66145c2e821ceb859f38cbdc302bf94a
MD5 17620195c2fd4ff78b13b5d4a4e0450b
SHA1 70ab219dbcac94d8d270bab94c217db565c5cc7d
SHA512 4958d34bd87cffbcd2ac6f4f831cdde3e94cd7d87f3adea8c4379ae6358e44126b9fac3eb39c39518a45cc637ac28dbf04b761ec4a4806cc73212e6d2c5afe67
SSDEEP 192:AoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiCHe2RUivDR4umo:49iIxuERzA83h09RZxYiGdR/
MD5 SHA1 SHA512 SSDEEP

Submit Download

EoodBKOmxYYeWeb Data

Path C:\Users\Admin\AppData\Local\Temp\spanXaI7koEj6MXZ\EoodBKOmxYYeWeb Data
Size 100KB
SHA256 2a38ab429847061aa3c614982e801e2e7139977a227466ce5ee61fa382a2bc2e
MD5 bfbf67a3ad4b5c0f7804f85d1f449a80
SHA1 110780a35d61de23b5fcb7b9e75a3ed07deb7838
SHA512 77bd3011b5d0074af16b93a5ab1967379a0a032bbf43c1e7b6ef205aeb27454e079c94e419bea6f7d730dc84b632e44250203a508fcdcd864ada9888381f4fdd
SSDEEP 192:L/UbavrNdV9bH9ITj8bGpnYANq6VGM6bIVumq:TAavrbV9D9knYANq69KIVumq
MD5 SHA1 SHA512 SSDEEP

Submit Download

NsGXQDPgMMo32peFzepQ.exe

Path C:\Users\Admin\AppData\Local\Temp\spanXaI7koEj6MXZ\NsGXQDPgMMo32peFzepQ.exe
Size 894KB
SHA256 b5cb9584b5ec7b3914cb9c8c15cb1721e3dfc5c3a887dbb9f4246039b7fe8e5e
MD5 fbca0f44407a64ce6ad7754cf4434d25
SHA1 ce8d6e59c0f5748c7dd7243e8f2757a3ca4bc52c
SHA512 aa180d02d334cdd4da7ff1780dc10269f7d022c25f4bc95d6d120c4d122d55ab09436981e736d8b363e9192deb4bdb1910510dbf0d4b4036efe7e18a66c14d08
SSDEEP 12288:bqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4Tf:bqDEvCTbMWu7rQYlBQcBiT6rprG8aAf
MD5 SHA1 SHA512 SSDEEP

Submit Download

SVvLY0hTe2NwfTJDLMOS.exe

Path C:\Users\Admin\AppData\Local\Temp\spanXaI7koEj6MXZ\SVvLY0hTe2NwfTJDLMOS.exe
Size 1.6MB
SHA256 790bcb0b262af0cc4c871e2fe66b9feebf405c42777e779adcf1ec97154403d1
MD5 c1811fc02576459d87a49b29b1d99ccc
SHA1 d1881be4b8b371c5635cc5a67692a6fe34c368ff
SHA512 24e806a75e924d85e1c6f23b5e296929e43f0d9fa9b0fa19ee2728349b7ebfac2a70592034efbd7c0dd127aa8b92fe0252c5d6ca5956e298872a44e45a246336
SSDEEP 49152:gtv5O3S01S+WX9HZQoSbashE8sLU9OJOvLlRaU:gh47WX95QTFxsLUoQvp
MD5 SHA1 SHA512 SSDEEP

Submit Download

h8X6BQ2qLEuGWeb Data

Path C:\Users\Admin\AppData\Local\Temp\spanXaI7koEj6MXZ\h8X6BQ2qLEuGWeb Data
Size 116KB
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
SSDEEP 192:CTPNbUJ6IH9xhomnGCTjHbRjCLqtzKWJaWtETVumQ6W:UPWJ6a9xpnQLqtzKWJnsVumQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1220-10-0x00000000004C0000-0x000000000100C000-memory.dmp

Download

memory/1220-13-0x00000000004C0000-0x000000000100C000-memory.dmp

Download

memory/1220-15-0x00000000004C0000-0x000000000100C000-memory.dmp

Download

memory/1220-16-0x00000000004C0000-0x000000000100C000-memory.dmp

Download

memory/1220-17-0x00000000004C0000-0x000000000100C000-memory.dmp

Download

memory/1220-18-0x00000000004C0000-0x000000000100C000-memory.dmp

Download

memory/1220-19-0x00000000004C0000-0x000000000100C000-memory.dmp

Download

memory/1220-20-0x00000000004C0000-0x000000000100C000-memory.dmp

Download

memory/1220-21-0x00000000004C0000-0x000000000100C000-memory.dmp

Download

memory/1220-14-0x00000000004C0000-0x000000000100C000-memory.dmp

Download

memory/1220-12-0x00000000004C0000-0x000000000100C000-memory.dmp

Download

memory/1220-11-0x00000000004C0000-0x000000000100C000-memory.dmp

Download

memory/1220-0-0x00000000004C0000-0x000000000100C000-memory.dmp

Download

memory/1220-8-0x00000000004C0000-0x000000000100C000-memory.dmp

Download

memory/1220-9-0x000000007EE60000-0x000000007F231000-memory.dmp

Download

memory/1220-7-0x00000000004C0000-0x000000000100C000-memory.dmp

Download

memory/1220-6-0x00000000004C0000-0x000000000100C000-memory.dmp

Download

memory/1220-2-0x00000000777C2000-0x00000000777C3000-memory.dmp

Download

memory/1220-1-0x000000007EE60000-0x000000007F231000-memory.dmp

Download