gh0strat | 754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345

Analysis

max time kernel
150s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe
Size 2.3MB
Sample240625-rcmf3atgpb
SHA256 754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345
MD5 0f6a26728980139ebdf317da66c36807
SHA1 2a54a95ed34bc0fd5d3e30301cf0e86383a68c83
SHA512 390a2d1c5fc8e6cd26f068b2220e7b8915ed2607780af080d1ddc1a9a12defe283223671cc25e9c9f36438d31334a9a86fbcb1a0d1d2386eb98469ce4aad124e
SSDEEP 24576:z09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+uginGsAJuH0:z09XJt4HIN2H2tFvduySogiGlN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat purplefox discovery evasion persistence rat rootkit spyware stealer trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 10 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/1596-6-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1596-10-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1596-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3984-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3984-17-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3984-21-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3984-16-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4700-28-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4700-37-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4700-54-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 10 IoCs

resource	yara_rule
behavioral2/memory/1596-6-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1596-10-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1596-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3984-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3984-17-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3984-21-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3984-16-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4700-28-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4700-37-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4700-54-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	HD_msedge.exe

Executes dropped EXE 21 IoCs

pid	Process
1596	RVN.exe
3984	TXPlatforn.exe
2712	HD_754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe
4700	TXPlatforn.exe
2952	msedge.exe
2000	RVN.exe
4232	TXPlatforn.exe
3212	TXPlatforn.exe
2412	HD_msedge.exe
1608	HD_msedge.exe
2240	HD_msedge.exe
2124	HD_msedge.exe
3088	HD_msedge.exe
1104	HD_msedge.exe
2588	HD_msedge.exe
2844	HD_msedge.exe
3116	HD_msedge.exe
3732	HD_msedge.exe
668	HD_msedge.exe
4776	HD_msedge.exe
1196	HD_msedge.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1596-4-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1596-6-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1596-10-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1596-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3984-13-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3984-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3984-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3984-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3984-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4700-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4700-37-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4700-54-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	HD_msedge.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	HD_msedge.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	HD_msedge.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2528	PING.EXE
3548	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2508	754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe
2508	754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe
2952	msedge.exe
2952	msedge.exe
2124	HD_msedge.exe
2124	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
3904	identity_helper.exe
3904	identity_helper.exe
1196	HD_msedge.exe
1196	HD_msedge.exe
1196	HD_msedge.exe
1196	HD_msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4700	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1596	RVN.exe
Token: SeLoadDriverPrivilege	4700	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2000	RVN.exe
Token: 33	4700	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	4700	TXPlatforn.exe
Token: 33	4700	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	4700	TXPlatforn.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe
2412	HD_msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2508	754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe
2508	754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1596	2508	754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe	81
PID 2508 wrote to memory of 1596	2508	754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe	81
PID 2508 wrote to memory of 1596	2508	754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe	81
PID 1596 wrote to memory of 3240	1596	RVN.exe	83
PID 1596 wrote to memory of 3240	1596	RVN.exe	83
PID 1596 wrote to memory of 3240	1596	RVN.exe	83
PID 3984 wrote to memory of 4700	3984	TXPlatforn.exe	84
PID 3984 wrote to memory of 4700	3984	TXPlatforn.exe	84
PID 3984 wrote to memory of 4700	3984	TXPlatforn.exe	84
PID 2508 wrote to memory of 2712	2508	754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe	85
PID 2508 wrote to memory of 2712	2508	754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe	85
PID 3240 wrote to memory of 2528	3240	cmd.exe	87
PID 3240 wrote to memory of 2528	3240	cmd.exe	87
PID 3240 wrote to memory of 2528	3240	cmd.exe	87
PID 2712 wrote to memory of 2952	2712	HD_754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe	88
PID 2712 wrote to memory of 2952	2712	HD_754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe	88
PID 2712 wrote to memory of 2952	2712	HD_754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe	88
PID 2952 wrote to memory of 2000	2952	msedge.exe	89
PID 2952 wrote to memory of 2000	2952	msedge.exe	89
PID 2952 wrote to memory of 2000	2952	msedge.exe	89
PID 2000 wrote to memory of 4252	2000	RVN.exe	91
PID 2000 wrote to memory of 4252	2000	RVN.exe	91
PID 2000 wrote to memory of 4252	2000	RVN.exe	91
PID 4232 wrote to memory of 3212	4232	TXPlatforn.exe	92
PID 4232 wrote to memory of 3212	4232	TXPlatforn.exe	92
PID 4232 wrote to memory of 3212	4232	TXPlatforn.exe	92
PID 2952 wrote to memory of 2412	2952	msedge.exe	94
PID 2952 wrote to memory of 2412	2952	msedge.exe	94
PID 2412 wrote to memory of 1608	2412	HD_msedge.exe	95
PID 2412 wrote to memory of 1608	2412	HD_msedge.exe	95
PID 4252 wrote to memory of 3548	4252	cmd.exe	96
PID 4252 wrote to memory of 3548	4252	cmd.exe	96
PID 4252 wrote to memory of 3548	4252	cmd.exe	96
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97
PID 2412 wrote to memory of 2240	2412	HD_msedge.exe	97

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	HD_msedge.exe

C:\Users\Admin\AppData\Local\Temp\754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe
"C:\Users\Admin\AppData\Local\Temp\754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\RVN.exe
  C:\Users\Admin\AppData\Local\Temp\\RVN.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2528
- C:\Users\Admin\AppData\Local\Temp\HD_754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe
  C:\Users\Admin\AppData\Local\Temp\HD_754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pc.weixin.qq.com/
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\RVN.exe
      C:\Users\Admin\AppData\Local\Temp\\RVN.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2000
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4252
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Checks system information in the registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3b1046f8,0x7ffa3b104708,0x7ffa3b104718
        5⤵
        Executes dropped EXE
        
        PID:1608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2052,3515075996672186261,1463763350175559089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:2240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,3515075996672186261,1463763350175559089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,3515075996672186261,1463763350175559089,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:3088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2052,3515075996672186261,1463763350175559089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2052,3515075996672186261,1463763350175559089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2052,3515075996672186261,1463763350175559089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4372 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2052,3515075996672186261,1463763350175559089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,3515075996672186261,1463763350175559089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
        5⤵
        
        PID:2212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,3515075996672186261,1463763350175559089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2052,3515075996672186261,1463763350175559089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2052,3515075996672186261,1463763350175559089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2052,3515075996672186261,1463763350175559089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2052,3515075996672186261,1463763350175559089,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3800 /prefetch:2
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1196

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:4700

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Executes dropped EXE
  PID:3212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
Size 3.2MB
SHA256 73d84d249f16b943d1d3f9dd9e516fadd323e70939c29b4a640693eb8818ee9a
MD5 ad8536c7440638d40156e883ac25086e
SHA1 fa9e8b7fb10473a01b8925c4c5b0888924a1147c
SHA512 b5f368be8853aa142dba614dcca7e021aba92b337fe36cfc186714092a4dab1c7a2181954cd737923edd351149980182a090dbde91081c81d83f471ff18888fe
SSDEEP 49152:+t3Pouv6sYIwNX7nw908hDspRqHZZOAQ6N2EMTTKgrMlTZZ2y/B5:+HCLX7nkDnaDIZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.8MB
SHA256 d4c871b40a17e4640b086d1c7efaf0e24cd2f486ab04430f512b7835569b8da3
MD5 096bf7b197f72201b4400dd7b5b98b6b
SHA1 1b92d3768389a117cbe416d70574e26c5e5c8907
SHA512 497afb04e6138e42c62f0f4af5f3ff0ffd7e38ffa1ecd8412443608d207f9e800d65179ccfefeb65c402f3bd41557eff305adf91baf3b9ee6005ddc42f9c93c9
SSDEEP 49152:z09XJt4HIN2H2tFvduySogSt3Pouv6sYIwNX7nw908hDspRqHZZOAQ6N2EMTTKgG:AZJt4HINy2LkVSHCLX7nkDnaDIZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b5c30858c3dc9c0752cc87eacb07dada10e9134a307ff3356aa6c25a62732230
MD5 fcae278913946e9706813ade311ce344
SHA1 ea8aa0374e6c53c27837e6e234f2a26af2eaa7c5
SHA512 3e06859ff1f03211769d33d90ee3a5cc6ac16a7155991a5b9dd5b1aad2d7dc615c7ce4820cbd80dc506bdbc152018174e10ac0014490aa142870a9aa83ef3434
SSDEEP 96:nJkXD1V4juwpvWMoiVmdeHvSS9UWQyV+VDCziEwb:nJkzf4juGWMXrro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b57a12967f7e260ea8cb6d61219ff8b7ceca85acb8f716cf7032610789c46a3f
MD5 dae9a34edabe09871f488783e8eeb2d0
SHA1 9cb16b7b55cb5dbbff9c8668ab451489ec69eeea
SHA512 78b5e37a3ba0663aa407a0f0f4535c25cd4f19926fb326df0d792af5b0d20e937c68fc5798af4b0a071714a603697315d8b4e9dc3afce5a6f41088be71a15267
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfke2RUX4uB:A9iIxuERzA83h09RZxYfKGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_754458df29c726ef106275c0a9b26e57400e73a81bf4ff00590ca9f4d7404345.exe
Size 647KB
SHA256 caaa46d47506f6503156f4ada2543981741250468a63d54bc6a937818372f9c4
MD5 776fdc0e7331d3d16a6e2eeb956a52b8
SHA1 1960568f4f7d47966e9ce5e3d6fd646b129fe322
SHA512 e53e244770c249622968133b8b217c5084d8cd55dba2a047dd1317deef080c04afa96ee2c51a8cf77ea9449e5d0d322e043ab88773c42c3677f9ed1db1557b8a
SSDEEP 6144:mntDDE565kzLGKlMy7j6solJL4KyyK29PRZH0:mntHE565kzLGnAj9AL4SnVH0
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.7MB
SHA256 bdc9e9d2c41db0e68670d6e58720830934faee15ab8e3896f44c7fc9cf6ec0d1
MD5 11a837255a8fe352d3ba83c03db227e5
SHA1 d94eda5ba02096fc7736e52b45dc2a5d56e84c92
SHA512 aaa45930e2838b9dbc00f9922cdd335e2d706da3cadec9d2778d519e2025648c839d8b68d3164dbfef2e44a8691bfe4ad9a92f99e865741517f6f6ed0ebb3bb9
SSDEEP 24576:z09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+ugG:z09XJt4HIN2H2tFvduySogG
MD5 SHA1 SHA512 SSDEEP

Submit Download

RVN.exe

Path C:\Users\Admin\AppData\Local\Temp\RVN.exe
Size 377KB
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
SSDEEP 6144:BEo7J1ixs4uVKE9rFEAHKThrBSq2hAzSM5mDo9lSJULHZqExlD2E1LxhJVwIe0Dy:Wo2HQVWAHkFSq2hAWJYlMUtrxlyuJVRq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1596-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1596-10-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1596-6-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1596-4-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2240-119-0x00007FFA47B50000-0x00007FFA47B51000-memory.dmp

Download

memory/3088-197-0x00000276E2BC0000-0x00000276E32FF000-memory.dmp

Download

memory/3984-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3984-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3984-21-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3984-17-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3984-13-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4700-54-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4700-37-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4700-28-0x0000000010000000-0x00000000101B6000-memory.dmp

Download