metasploit | 91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31

General

Target

91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
Size

1.8MB
MD5

9c01b2c8d57276282b166131895b43ab
SHA1

f5fc5501ebf05154e7c87ca0ba0414ba1a5eb657
SHA256

91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31
SHA512

fbe51654e6e28de7549e984e1d7056ddea9abdbff7570c3c14e0c4951e45aad8be9e9aec239be752b6ebe0367b375715ca27db10706d0e6567dd0fe17be06c95
SSDEEP

24576:/3vLRdVhZBK8NogWYO09VOGi9J3YiWdCMJ5QxmjwC/hR:/3d5ZQ1TxJIiW0MbQxA

Score

10^/10

metasploit backdoor discovery spyware stealer trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

1.15.12.73:4567

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Drops file in Drivers directory 1 IoCs

Processes:

91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe

description	ioc	process
File opened (read-only)	\??\P:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\Q:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\U:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\V:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\B:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\K:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\H:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\J:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\L:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\N:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\R:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\T:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\A:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\E:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\X:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\G:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\I:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\S:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\W:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\Y:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\Z:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\M:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
File opened (read-only)	\??\O:	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4156	msedge.exe
4156	msedge.exe
2920	msedge.exe
2920	msedge.exe
4552	identity_helper.exe
4552	identity_helper.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe

description	pid	process
Token: SeDebugPrivilege	1712	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
Token: SeDebugPrivilege	1712	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
Token: SeDebugPrivilege	3524	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
Token: SeDebugPrivilege	3524	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exemsedge.exe

description	pid	process	target process
PID 1712 wrote to memory of 3524	1712	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
PID 1712 wrote to memory of 3524	1712	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
PID 1712 wrote to memory of 3524	1712	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
PID 3524 wrote to memory of 2920	3524	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe	msedge.exe
PID 3524 wrote to memory of 2920	3524	91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe	msedge.exe
PID 2920 wrote to memory of 516	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 516	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 5108	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 4156	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 4156	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 4800	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 4800	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 4800	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 4800	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 4800	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 4800	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 4800	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 4800	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 4800	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 4800	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 4800	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 4800	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 4800	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 4800	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 4800	2920	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
"C:\Users\Admin\AppData\Local\Temp\91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712

C:\Users\Admin\AppData\Local\Temp\91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe
"C:\Users\Admin\AppData\Local\Temp\91cb53702678b63ba48c78df4f75d72666af28a2a07f8ffb54c6732e2af28c31.exe" Admin
2⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm
3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdad846f8,0x7ffcdad84708,0x7ffcdad84718
4⤵
PID:516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4394565133624398324,1696010237207370374,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
4⤵
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,4394565133624398324,1696010237207370374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,4394565133624398324,1696010237207370374,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
4⤵
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4394565133624398324,1696010237207370374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
4⤵
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4394565133624398324,1696010237207370374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
4⤵
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4394565133624398324,1696010237207370374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 /prefetch:8
4⤵
PID:2328

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4394565133624398324,1696010237207370374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4394565133624398324,1696010237207370374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
4⤵
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4394565133624398324,1696010237207370374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
4⤵
PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4394565133624398324,1696010237207370374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
4⤵
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4394565133624398324,1696010237207370374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
4⤵
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4394565133624398324,1696010237207370374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
4⤵
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4394565133624398324,1696010237207370374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
4⤵
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4394565133624398324,1696010237207370374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1
4⤵
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4394565133624398324,1696010237207370374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:1
4⤵
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4394565133624398324,1696010237207370374,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5632 /prefetch:2
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
11e501a9f8e17da7493fd00fd7fec994

SHA1
fa260c65ea06d9bf7ef037ddc2647135d2229f66

SHA256
a5607bf9c34dc1f35412e6fed52bbbd73dbec8fe2d7064050a9aca95986ffa37

SHA512
0f08ce193b61a3964fa4d2d151a6be53727be2a4418e9b0df83df190663318640c5c522dfc7b25ed30bc313c7a8972425548386a76681c1c5e2107a4081629ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b9b6c193587c1426eff063bb2d0de7d9

SHA1
ede5377df77f6f58f28651ba5df158a042cb2c5f

SHA256
8edb041a9c743fa15fc0b4fc3b802898d27d95f20c93253bf0e9483816914d8c

SHA512
57cba8ecb14948a011744a3ad2ed2a81a2613fbd9436aacc64b6180b17fb8efff92f1bdf400f08453f3371f8834bf91ac145ec64b2b1ffe5a754645c229ac477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
36a1cffabfa109499829216d4bab8215

SHA1
9f8ce027080163c1e0eded9e85278441c677950f

SHA256
c95f4e6b380092871f1d4c4b0243075b533111c9c9b0261ebef16f36df829c00

SHA512
249bca5b6b4e61eaa7d4c47ea3d75e07cee05188e982134e8db33e61b02a6abca77b69344dfc3db53fa0fc141a76eab6ce0874b447648ad38fcec46ff0f7d22c

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
822B

MD5
03450e8ddb20859f242195450c19b8f1

SHA1
9698f8caf67c8853e14c8bf4933949f458c3044a

SHA256
1bdd8f1dd7bd82b5b2313d8770dfe4f41cd3f45bbaeab8b8a7f75fc5e2d3720b

SHA512
87371e57bf2296af5ec7f5db772a4ce66729d54aa23a8b384e3f4c42310b97b636576c7dff67c27a3b679339cdeee05b836563ae2a878f0367caf247b3e1ba7b

Download Submit
\??\pipe\LOCAL\crashpad_2920_PXSBDFLJJXFTIVYV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1712-4-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/1712-0-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/1712-2-0x0000000002770000-0x0000000002771000-memory.dmp

Filesize
4KB

Download
memory/1712-1-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/3524-11-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/3524-9-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/3524-6-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads