metasploit | e820bfb981d7c546552e684d1f4415837218c27209b5d83a71ba81356109fd0f

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
Size 1.8MB
Sample240617-bfwwxa1ejj
SHA256 e820bfb981d7c546552e684d1f4415837218c27209b5d83a71ba81356109fd0f
MD5 2a6f136ba282dd31b644c9c6d4c67d60
SHA1 a7246096effb63e576c238114ec2df5b8f180bb6
SHA512 206615d0d6d13494ecc9b346761bea497162195d65a19b4e8ac4f2eedaa75ee565904c13c73f792ea36ef6451b1553d95d9ca7ac883bfb2d78539827a85467a9
SSDEEP 24576:/3vLRdVhZBK8NogWYO096OGi9JdLegMZt4zEyje0sMsvjwC/hR:/3d5ZQ1+xJhL2h0J+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit backdoor discovery spyware stealer trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

1.15.12.73:4567

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\P:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\S:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\T:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\W:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\H:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\N:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\U:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\V:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\Y:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\A:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\L:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\J:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\M:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\B:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\G:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\K:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\Q:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\R:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\X:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\Z:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\E:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
File opened (read-only)	\??\I:	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
3104	msedge.exe
3104	msedge.exe
4840	identity_helper.exe
4840	identity_helper.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1784	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
Token: SeDebugPrivilege	1784	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
Token: SeDebugPrivilege	228	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
Token: SeDebugPrivilege	228	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 228	1784	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe	83
PID 1784 wrote to memory of 228	1784	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe	83
PID 1784 wrote to memory of 228	1784	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe	83
PID 228 wrote to memory of 3104	228	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe	86
PID 228 wrote to memory of 3104	228	2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe	86
PID 3104 wrote to memory of 3444	3104	msedge.exe	87
PID 3104 wrote to memory of 3444	3104	msedge.exe	87
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 5092	3104	msedge.exe	88
PID 3104 wrote to memory of 4592	3104	msedge.exe	89
PID 3104 wrote to memory of 4592	3104	msedge.exe	89
PID 3104 wrote to memory of 1652	3104	msedge.exe	90
PID 3104 wrote to memory of 1652	3104	msedge.exe	90
PID 3104 wrote to memory of 1652	3104	msedge.exe	90
PID 3104 wrote to memory of 1652	3104	msedge.exe	90
PID 3104 wrote to memory of 1652	3104	msedge.exe	90
PID 3104 wrote to memory of 1652	3104	msedge.exe	90
PID 3104 wrote to memory of 1652	3104	msedge.exe	90
PID 3104 wrote to memory of 1652	3104	msedge.exe	90
PID 3104 wrote to memory of 1652	3104	msedge.exe	90
PID 3104 wrote to memory of 1652	3104	msedge.exe	90
PID 3104 wrote to memory of 1652	3104	msedge.exe	90
PID 3104 wrote to memory of 1652	3104	msedge.exe	90
PID 3104 wrote to memory of 1652	3104	msedge.exe	90
PID 3104 wrote to memory of 1652	3104	msedge.exe	90
PID 3104 wrote to memory of 1652	3104	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\AppData\Local\Temp\2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\2a6f136ba282dd31b644c9c6d4c67d60_NeikiAnalytics.exe" Admin
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdeb9646f8,0x7ffdeb964708,0x7ffdeb964718
      4⤵
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,15584941246692314547,7070598750626001900,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,15584941246692314547,7070598750626001900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,15584941246692314547,7070598750626001900,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
      4⤵
      PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15584941246692314547,7070598750626001900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15584941246692314547,7070598750626001900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,15584941246692314547,7070598750626001900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 /prefetch:8
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,15584941246692314547,7070598750626001900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15584941246692314547,7070598750626001900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
      4⤵
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15584941246692314547,7070598750626001900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15584941246692314547,7070598750626001900,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
      4⤵
      PID:116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15584941246692314547,7070598750626001900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
      4⤵
      PID:2572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15584941246692314547,7070598750626001900,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15584941246692314547,7070598750626001900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2176 /prefetch:1
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15584941246692314547,7070598750626001900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15584941246692314547,7070598750626001900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
      4⤵
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,15584941246692314547,7070598750626001900,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5204 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 906413ae36d672a741b99ef6b7e3bfa0b0d32d975c0764e9d9672b12ca56ddeb
MD5 eb68d56ae41806de3d926a0dadc9dd25
SHA1 dfc2f87c9e9b3e520faaee2c0d17c986fa7abba7
SHA512 24a590c898c59782def2c9ce1a8f035a30be048ed4e0afd5015e37eb7de64de2cba854c0fe03a06e22aaed3c374a6b6bc1b14566107b9e2cdb94789b2706ad48
SSDEEP 96:nmk0O1Fv0wpvWMoiVmdeH/ztmUWQyV+VDCziEwb:nmkbf8GWMXcro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ca125a6d155a3d1dc046753b89fbf40249100f9cbf46fdf0919315713d796b51
MD5 2b06350c66cefb41c8f9b179e1846375
SHA1 7ff33c9e09e4eafc9389f501ec0fb5833bd4e150
SHA512 97e9973e98bb17a6ef0946c843bf36109d674a6281fbda231aab4d82a5444227b74f53fcb3bc0d1d3265f19af1fa475be35a63fe3638c98d4d916b392ed90c05
SSDEEP 96:nmk0O1Nv0wpvWMoiVmdeH/ztmUWQyV+VD7AiEwb:nmkbT8GWMXcrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d1a604488aaea8d9c51b4bd278ce18d3a0430912bbdc646b907edbebc54f3043
MD5 4d1875ccbf49a6f3434832424b7ec01e
SHA1 7b34ce24c87595514a927e4830dc17d255e343e6
SHA512 642b7fe79fbbd739cf47e71930eeaf2a9ac9a4ed1ea43caec13df107f15443557772b96775502cfe0f0ac010249050c3423a7813f3b38bad9a044996066c5c9a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup/vPVe2RU6Hi/myi:A9iIxuERzA83h09RZxYXJ6Vi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/228-11-0x0000000000400000-0x00000000005E5000-memory.dmp

Download

memory/228-9-0x0000000000400000-0x00000000005E5000-memory.dmp

Download

memory/228-6-0x0000000000750000-0x0000000000751000-memory.dmp

Download

memory/1784-0-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/1784-4-0x0000000000400000-0x00000000005E5000-memory.dmp

Download

memory/1784-2-0x0000000000730000-0x0000000000731000-memory.dmp

Download

memory/1784-1-0x0000000000680000-0x0000000000681000-memory.dmp

Download