umbral | ed5fe58c45c8b0e48c4c9405ba8065234090e19e145465117e0d2342f43fd872

Analysis

max time kernel
153s
max time network
282s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
20-07-2024 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Krampus/b5uEJHZB6Rl.exe
Size

231KB
MD5

438289fb9c72ed39bf5497f9af21ec7a
SHA1

8120391ecb41ed6a4c6ef0b259776e59311d6997
SHA256

ea4cb7c7b4cfb2fcc04d1c3f96b20c26638e69a97b15cae14659f0d6afb78f85
SHA512

3647907fa2d503a242ef07cb20b081444b75e0c618a91232c8e77903b4b6aa823b8a7cbe07a45e02591fe48fdd23b5eae88565006b85863c0a5f6e42d7589fe0
SSDEEP

6144:YloZM+rIkd8g+EtXHkv/iD4Bs4DdLocD/abtIEx6tb8e1mTiu:GoZtL+EP8Bs4DdLocD/abtIExq1

Score

10^/10

umbral execution spyware stealer

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/memory/1036-0-0x0000023939A10000-0x0000023939A50000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3664	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	b5uEJHZB6Rl.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	discord.com
6	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2400	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3736	PING.EXE

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1036	b5uEJHZB6Rl.exe
3664	powershell.exe
3664	powershell.exe
5096	powershell.exe
5096	powershell.exe
1916	powershell.exe
1916	powershell.exe
464	powershell.exe
464	powershell.exe
240	powershell.exe
240	powershell.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
2344	msedge.exe
2344	msedge.exe
2732	msedge.exe
2732	msedge.exe
396	identity_helper.exe
396	identity_helper.exe
2244	msedge.exe
2244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1036	b5uEJHZB6Rl.exe
Token: SeIncreaseQuotaPrivilege	2836	wmic.exe
Token: SeSecurityPrivilege	2836	wmic.exe
Token: SeTakeOwnershipPrivilege	2836	wmic.exe
Token: SeLoadDriverPrivilege	2836	wmic.exe
Token: SeSystemProfilePrivilege	2836	wmic.exe
Token: SeSystemtimePrivilege	2836	wmic.exe
Token: SeProfSingleProcessPrivilege	2836	wmic.exe
Token: SeIncBasePriorityPrivilege	2836	wmic.exe
Token: SeCreatePagefilePrivilege	2836	wmic.exe
Token: SeBackupPrivilege	2836	wmic.exe
Token: SeRestorePrivilege	2836	wmic.exe
Token: SeShutdownPrivilege	2836	wmic.exe
Token: SeDebugPrivilege	2836	wmic.exe
Token: SeSystemEnvironmentPrivilege	2836	wmic.exe
Token: SeRemoteShutdownPrivilege	2836	wmic.exe
Token: SeUndockPrivilege	2836	wmic.exe
Token: SeManageVolumePrivilege	2836	wmic.exe
Token: 33	2836	wmic.exe
Token: 34	2836	wmic.exe
Token: 35	2836	wmic.exe
Token: 36	2836	wmic.exe
Token: SeIncreaseQuotaPrivilege	2836	wmic.exe
Token: SeSecurityPrivilege	2836	wmic.exe
Token: SeTakeOwnershipPrivilege	2836	wmic.exe
Token: SeLoadDriverPrivilege	2836	wmic.exe
Token: SeSystemProfilePrivilege	2836	wmic.exe
Token: SeSystemtimePrivilege	2836	wmic.exe
Token: SeProfSingleProcessPrivilege	2836	wmic.exe
Token: SeIncBasePriorityPrivilege	2836	wmic.exe
Token: SeCreatePagefilePrivilege	2836	wmic.exe
Token: SeBackupPrivilege	2836	wmic.exe
Token: SeRestorePrivilege	2836	wmic.exe
Token: SeShutdownPrivilege	2836	wmic.exe
Token: SeDebugPrivilege	2836	wmic.exe
Token: SeSystemEnvironmentPrivilege	2836	wmic.exe
Token: SeRemoteShutdownPrivilege	2836	wmic.exe
Token: SeUndockPrivilege	2836	wmic.exe
Token: SeManageVolumePrivilege	2836	wmic.exe
Token: 33	2836	wmic.exe
Token: 34	2836	wmic.exe
Token: 35	2836	wmic.exe
Token: 36	2836	wmic.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeIncreaseQuotaPrivilege	1208	wmic.exe
Token: SeSecurityPrivilege	1208	wmic.exe
Token: SeTakeOwnershipPrivilege	1208	wmic.exe
Token: SeLoadDriverPrivilege	1208	wmic.exe
Token: SeSystemProfilePrivilege	1208	wmic.exe
Token: SeSystemtimePrivilege	1208	wmic.exe
Token: SeProfSingleProcessPrivilege	1208	wmic.exe
Token: SeIncBasePriorityPrivilege	1208	wmic.exe
Token: SeCreatePagefilePrivilege	1208	wmic.exe
Token: SeBackupPrivilege	1208	wmic.exe
Token: SeRestorePrivilege	1208	wmic.exe
Token: SeShutdownPrivilege	1208	wmic.exe
Token: SeDebugPrivilege	1208	wmic.exe
Token: SeSystemEnvironmentPrivilege	1208	wmic.exe
Token: SeRemoteShutdownPrivilege	1208	wmic.exe
Token: SeUndockPrivilege	1208	wmic.exe
Token: SeManageVolumePrivilege	1208	wmic.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
4828	taskmgr.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3932	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 2836	1036	b5uEJHZB6Rl.exe	82
PID 1036 wrote to memory of 2836	1036	b5uEJHZB6Rl.exe	82
PID 1036 wrote to memory of 2328	1036	b5uEJHZB6Rl.exe	85
PID 1036 wrote to memory of 2328	1036	b5uEJHZB6Rl.exe	85
PID 1036 wrote to memory of 3664	1036	b5uEJHZB6Rl.exe	87
PID 1036 wrote to memory of 3664	1036	b5uEJHZB6Rl.exe	87
PID 1036 wrote to memory of 5096	1036	b5uEJHZB6Rl.exe	89
PID 1036 wrote to memory of 5096	1036	b5uEJHZB6Rl.exe	89
PID 1036 wrote to memory of 1916	1036	b5uEJHZB6Rl.exe	91
PID 1036 wrote to memory of 1916	1036	b5uEJHZB6Rl.exe	91
PID 1036 wrote to memory of 464	1036	b5uEJHZB6Rl.exe	93
PID 1036 wrote to memory of 464	1036	b5uEJHZB6Rl.exe	93
PID 1036 wrote to memory of 1208	1036	b5uEJHZB6Rl.exe	95
PID 1036 wrote to memory of 1208	1036	b5uEJHZB6Rl.exe	95
PID 1036 wrote to memory of 5004	1036	b5uEJHZB6Rl.exe	97
PID 1036 wrote to memory of 5004	1036	b5uEJHZB6Rl.exe	97
PID 1036 wrote to memory of 2840	1036	b5uEJHZB6Rl.exe	99
PID 1036 wrote to memory of 2840	1036	b5uEJHZB6Rl.exe	99
PID 1036 wrote to memory of 240	1036	b5uEJHZB6Rl.exe	101
PID 1036 wrote to memory of 240	1036	b5uEJHZB6Rl.exe	101
PID 1036 wrote to memory of 2400	1036	b5uEJHZB6Rl.exe	103
PID 1036 wrote to memory of 2400	1036	b5uEJHZB6Rl.exe	103
PID 1036 wrote to memory of 852	1036	b5uEJHZB6Rl.exe	105
PID 1036 wrote to memory of 852	1036	b5uEJHZB6Rl.exe	105
PID 852 wrote to memory of 3736	852	cmd.exe	107
PID 852 wrote to memory of 3736	852	cmd.exe	107
PID 2344 wrote to memory of 2400	2344	msedge.exe	121
PID 2344 wrote to memory of 2400	2344	msedge.exe	121
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122
PID 2344 wrote to memory of 1752	2344	msedge.exe	122

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2328	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Krampus\b5uEJHZB6Rl.exe
"C:\Users\Admin\AppData\Local\Temp\Krampus\b5uEJHZB6Rl.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\SYSTEM32\attrib.exe
  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Krampus\b5uEJHZB6Rl.exe"
  2⤵
  - Views/modifies file attributes
  PID:2328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Krampus\b5uEJHZB6Rl.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1208
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" computersystem get totalphysicalmemory
  2⤵
  PID:5004
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:2840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:240
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:2400
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Krampus\b5uEJHZB6Rl.exe" && pause
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\system32\PING.EXE
    ping localhost
    3⤵
    - Runs ping.exe
    PID:3736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5096

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4040

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:1584

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc777f3cb8,0x7ffc777f3cc8,0x7ffc777f3cd8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,752038849217286063,14307805991917137294,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,752038849217286063,14307805991917137294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,752038849217286063,14307805991917137294,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,752038849217286063,14307805991917137294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,752038849217286063,14307805991917137294,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,752038849217286063,14307805991917137294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,752038849217286063,14307805991917137294,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,752038849217286063,14307805991917137294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2004,752038849217286063,14307805991917137294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,752038849217286063,14307805991917137294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,752038849217286063,14307805991917137294,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,752038849217286063,14307805991917137294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2200

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fe10b6cb6b345a095320391bda78b22

SHA1
46c36ab1994b86094f34a0fbae3a3921d6690862

SHA256
85a627e9b109e179c49cf52420ad533db38e75bc131714a25c1ae92dd1d05239

SHA512
9f9d689662da014dfae3565806903de291c93b74d11b47a94e7e3846537e029e1b61ad2fad538b10344641003da4d7409c3dd834fed3a014c56328ae76983a2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
caaeb604a99d78c4a41140a3082ca660

SHA1
6d9cd8a52c0f2cd9b48b00f612ec33cd7ca0aa97

SHA256
75e15f595387aec18f164aa0d6573c1564aaa49074547a2d48a9908d22a3b5d6

SHA512
1091aa1e8bf74ed74ad8eb8fa25c4e24b6cfd0496482e526ef915c5a7d431f05360b87d07c11b93eb9296fe386d71e99d214afce163c2d01505349c52f2d5d66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ed58a474eaf6153e897bd04a5a6a57a0

SHA1
1908582a80bc8cfc1cc13b72d1f37e7c04beb920

SHA256
7aed6fab649b6a13798eb5d33ec5907b374619e737627903a7123f4221ca67a8

SHA512
4927a1bfa61a2cd8f3ebd7fd1050f92cc9136118fd138e161f1e96c1b57456e500107d39be7035f2a502f173c4690e211a245246a807f737411ae16e0a9b8808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
18c3617b317f5772869bdefa2135ce77

SHA1
e31f964bc331ad9c4c692ccc90c3174b52985111

SHA256
403f61e70d4e9d6162fc5c38fbdd29d90e2587409e51e7a320b793e7cc5dc6d6

SHA512
f36f4dc3adae3e8a7b073adbca9e48dc3d3f1136e220cb955df57b5e15bf534ee1d31e5c78b6561cd37771626518a3c08f2591d74eefac1a412ec1f7f514cb7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
147821afc43793da5026860c00dca390

SHA1
f11c268ad6ab86143e8113b51a0558524ff039b6

SHA256
e2689a2cf0c10d0fe1ae03d17b8661186fac1996c1adf69a2e8cea8f3629178b

SHA512
8832b79402a41684a93ff3795c4db0931ce6503e7f3e218decca70447c52725df20ea50f399da580aa1f15d15b106f8c14673f5e9678be21361d160d62ac209a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cf812261512e73cdeb5c3924882701f4

SHA1
5ac9d7b256d7a2045cc4f31c912d534b48ea2c33

SHA256
4ef54749d8d5cca3f4ed58357f2f76c9cdeb20d2d79b69d2f78f0e9af0038e9d

SHA512
b7719a1d8f401c6f4e8b5dffe22a9e59dad2af79a6b0e30956f938957b33e5ca87d25bf570773130d1a68a14cfb1779d2453e30f8d7f9f9ef6ac79046764a91e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d28ac74f52a133bab7e1a38341dccd23

SHA1
5a0cfbe76c29f83df6be86419f6074aa891471f0

SHA256
1b60cae13d0796e444a03a05039dcd9276a408f5550791792e78b04b8c2aa71e

SHA512
1e55d49bbe44263e810622eebd0cdd86051331eca2ac5df3f52354bd2d977b51b23b2bd439c5f941b45ca002ff13f366a014658bfab7f32be64a53eeb10a90fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e3840d9bcedfe7017e49ee5d05bd1c46

SHA1
272620fb2605bd196df471d62db4b2d280a363c6

SHA256
3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f

SHA512
76adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
fa21dd50b4e64421076f843031c8ccf7

SHA1
2c56e94f130c0d8d77116e939ffee4e37cf982bd

SHA256
e4f21aca1e12aafa8de7af24b79a75526e902c7d4b3fea5bdb6e723976997be3

SHA512
b8de2bfeb7af06c587dd1f424d410cf83471f31a55a3ea4c4481ce07ffd9bf66ddc1f7775ecd6ac65ac33baaec90ba5a208a9aefc84f31125a50dfb919982687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0ac871344dc49ae49f13f0f88acb4868

SHA1
5a073862375c7e79255bb0eab32c635b57a77f98

SHA256
688f15b59a784f6f4c62554f00b5d0840d1489cef989c18126c70dfee0806d37

SHA512
ace5c50303bd27998607cf34ac4322bcf5edfbd19bbb24309acf4d037b6f3f7636c7c14b6ac0b924114e036252d3a1b998951c7068f41548728fa5d92f5f9006

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9b2acf080a432c89852a69291f7fe29e

SHA1
86df0be9e718ae80e6e6064f52b7d60a98f2725d

SHA256
126f1d64010a2da8956f4deb3980f19ec01d48693054efd7b8b38ff62209b927

SHA512
a4fd1da4c1a9c8e072f66516da5dae12682eea44473b43d18ae0999b004e19ddbc2294be5d1d3b622a22189e9176a42a5de76229143d30c1649ba7116d17aa27

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
1015d2fd919a3b62e193194c7bfafbef

SHA1
f7f3314dd817edcee90f87491f74825b197f476b

SHA256
990002e556b74d16e89d7f6c8be6ac5870e9be8b904ec52e87d92631fa09467b

SHA512
ffc7702179fb30851f4646f26a53e87c0215e320e117901c726a6294bf428540134e1fd14fce37a0b430e8379b4c56d6f57b582efff5654e2ed4624453762bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gjk3x412.zgz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/1036-85-0x00007FFC66250000-0x00007FFC66D12000-memory.dmp

Filesize
10.8MB

Download
memory/1036-31-0x000002393BA20000-0x000002393BA96000-memory.dmp

Filesize
472KB

Download
memory/1036-1-0x00007FFC66253000-0x00007FFC66255000-memory.dmp

Filesize
8KB

Download
memory/1036-2-0x00007FFC66250000-0x00007FFC66D12000-memory.dmp

Filesize
10.8MB

Download
memory/1036-33-0x000002393B820000-0x000002393B83E000-memory.dmp

Filesize
120KB

Download
memory/1036-67-0x000002393B860000-0x000002393B86A000-memory.dmp

Filesize
40KB

Download
memory/1036-68-0x000002393B890000-0x000002393B8A2000-memory.dmp

Filesize
72KB

Download
memory/1036-32-0x0000023954290000-0x00000239542E0000-memory.dmp

Filesize
320KB

Download
memory/1036-0-0x0000023939A10000-0x0000023939A50000-memory.dmp

Filesize
256KB

Download
memory/3664-14-0x00007FFC66250000-0x00007FFC66D12000-memory.dmp

Filesize
10.8MB

Download
memory/3664-17-0x00007FFC66250000-0x00007FFC66D12000-memory.dmp

Filesize
10.8MB

Download
memory/3664-12-0x00007FFC66250000-0x00007FFC66D12000-memory.dmp

Filesize
10.8MB

Download
memory/3664-11-0x0000022E6C660000-0x0000022E6C682000-memory.dmp

Filesize
136KB

Download
memory/3664-13-0x00007FFC66250000-0x00007FFC66D12000-memory.dmp

Filesize
10.8MB

Download
memory/4828-97-0x000001D211080000-0x000001D211081000-memory.dmp

Filesize
4KB

Download
memory/4828-98-0x000001D211080000-0x000001D211081000-memory.dmp

Filesize
4KB

Download
memory/4828-87-0x000001D211080000-0x000001D211081000-memory.dmp

Filesize
4KB

Download
memory/4828-93-0x000001D211080000-0x000001D211081000-memory.dmp

Filesize
4KB

Download
memory/4828-99-0x000001D211080000-0x000001D211081000-memory.dmp

Filesize
4KB

Download
memory/4828-96-0x000001D211080000-0x000001D211081000-memory.dmp

Filesize
4KB

Download
memory/4828-94-0x000001D211080000-0x000001D211081000-memory.dmp

Filesize
4KB

Download
memory/4828-95-0x000001D211080000-0x000001D211081000-memory.dmp

Filesize
4KB

Download
memory/4828-88-0x000001D211080000-0x000001D211081000-memory.dmp

Filesize
4KB

Download
memory/4828-89-0x000001D211080000-0x000001D211081000-memory.dmp

Filesize
4KB

Download