5293e722ecf4aa4b69f8b01bb782bf514c623ec63e22949410fcb938a1a3d8b0

Analysis

max time kernel
42s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Miro.exe
Size

169.1MB
MD5

c49b0bba64ba58de01de9c20383c3498
SHA1

20f3218a7aaf54054c288258ea0d9a4fc70ec2da
SHA256

4d955bdf41dd67a4de9982eb10903515708c8f575e7c6ecf628663e2cd1f451a
SHA512

5af3364d22703bdd09479c0c82581dff5cea7e1665eb70b5a9c34a57cdde772dd89546a0b162225e4929b4380f73db62fb4a57f0918a0725aa08367710d38f71
SSDEEP

1572864:/BM/UtXNx6TMYXq8BiJRiWnO52TwdV/8ViAYia0adUXQbxVUFv3J99jyFpPag4EP:qULDiLzuyzagNV

Score

5^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	Miro.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	Miro.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	Miro.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	Miro.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	Miro.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	Miro.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3048	powershell.exe
4692	powershell.exe
3356	powershell.exe
2196	powershell.exe
4932	powershell.exe
1804	powershell.exe
1384	powershell.exe
1684	powershell.exe
1232	powershell.exe
4232	powershell.exe
3020	powershell.exe
5096	powershell.exe
4500	powershell.exe
2276	powershell.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Miro.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Miro.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Miro.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Miro.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Miro.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Miro.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Miro.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\miroapp\shell\open	Miro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\miroapp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Miro.exe\" \"%1\""	Miro.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\miroapp	Miro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\miroapp\URL Protocol	Miro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\miroapp\ = "URL:miroapp"	Miro.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\miroapp\shell\open\command	Miro.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\miroapp\shell	Miro.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5096	powershell.exe
5096	powershell.exe
3048	powershell.exe
3048	powershell.exe
4692	powershell.exe
4692	powershell.exe
4232	powershell.exe
4232	powershell.exe
3356	powershell.exe
3356	powershell.exe
3020	powershell.exe
3020	powershell.exe
1384	powershell.exe
1384	powershell.exe
3020	powershell.exe
5096	powershell.exe
4692	powershell.exe
4232	powershell.exe
1384	powershell.exe
3356	powershell.exe
3048	powershell.exe
1804	powershell.exe
1804	powershell.exe
1232	powershell.exe
1232	powershell.exe
4932	powershell.exe
4932	powershell.exe
4500	powershell.exe
4500	powershell.exe
2196	powershell.exe
2196	powershell.exe
1684	powershell.exe
1684	powershell.exe
2276	powershell.exe
2276	powershell.exe
1232	powershell.exe
1804	powershell.exe
4932	powershell.exe
1684	powershell.exe
2276	powershell.exe
2196	powershell.exe
4500	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3396	Miro.exe
Token: SeCreatePagefilePrivilege	3396	Miro.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	3356	powershell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeShutdownPrivilege	3396	Miro.exe
Token: SeCreatePagefilePrivilege	3396	Miro.exe
Token: SeShutdownPrivilege	3396	Miro.exe
Token: SeCreatePagefilePrivilege	3396	Miro.exe
Token: SeShutdownPrivilege	3396	Miro.exe
Token: SeCreatePagefilePrivilege	3396	Miro.exe
Token: SeIncreaseQuotaPrivilege	3356	powershell.exe
Token: SeSecurityPrivilege	3356	powershell.exe
Token: SeTakeOwnershipPrivilege	3356	powershell.exe
Token: SeLoadDriverPrivilege	3356	powershell.exe
Token: SeSystemProfilePrivilege	3356	powershell.exe
Token: SeSystemtimePrivilege	3356	powershell.exe
Token: SeProfSingleProcessPrivilege	3356	powershell.exe
Token: SeIncBasePriorityPrivilege	3356	powershell.exe
Token: SeCreatePagefilePrivilege	3356	powershell.exe
Token: SeBackupPrivilege	3356	powershell.exe
Token: SeRestorePrivilege	3356	powershell.exe
Token: SeShutdownPrivilege	3356	powershell.exe
Token: SeDebugPrivilege	3356	powershell.exe
Token: SeSystemEnvironmentPrivilege	3356	powershell.exe
Token: SeRemoteShutdownPrivilege	3356	powershell.exe
Token: SeUndockPrivilege	3356	powershell.exe
Token: SeManageVolumePrivilege	3356	powershell.exe
Token: 33	3356	powershell.exe
Token: 34	3356	powershell.exe
Token: 35	3356	powershell.exe
Token: 36	3356	powershell.exe
Token: SeIncreaseQuotaPrivilege	3020	powershell.exe
Token: SeSecurityPrivilege	3020	powershell.exe
Token: SeTakeOwnershipPrivilege	3020	powershell.exe
Token: SeLoadDriverPrivilege	3020	powershell.exe
Token: SeSystemProfilePrivilege	3020	powershell.exe
Token: SeSystemtimePrivilege	3020	powershell.exe
Token: SeProfSingleProcessPrivilege	3020	powershell.exe
Token: SeIncBasePriorityPrivilege	3020	powershell.exe
Token: SeCreatePagefilePrivilege	3020	powershell.exe
Token: SeBackupPrivilege	3020	powershell.exe
Token: SeRestorePrivilege	3020	powershell.exe
Token: SeShutdownPrivilege	3020	powershell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeSystemEnvironmentPrivilege	3020	powershell.exe
Token: SeRemoteShutdownPrivilege	3020	powershell.exe
Token: SeUndockPrivilege	3020	powershell.exe
Token: SeManageVolumePrivilege	3020	powershell.exe
Token: 33	3020	powershell.exe
Token: 34	3020	powershell.exe
Token: 35	3020	powershell.exe
Token: 36	3020	powershell.exe
Token: SeIncreaseQuotaPrivilege	1384	powershell.exe
Token: SeSecurityPrivilege	1384	powershell.exe
Token: SeTakeOwnershipPrivilege	1384	powershell.exe
Token: SeLoadDriverPrivilege	1384	powershell.exe
Token: SeSystemProfilePrivilege	1384	powershell.exe
Token: SeSystemtimePrivilege	1384	powershell.exe
Token: SeProfSingleProcessPrivilege	1384	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 1804	3396	Miro.exe	85
PID 3396 wrote to memory of 1804	3396	Miro.exe	85
PID 1804 wrote to memory of 2568	1804	cmd.exe	87
PID 1804 wrote to memory of 2568	1804	cmd.exe	87
PID 3396 wrote to memory of 1032	3396	Miro.exe	88
PID 3396 wrote to memory of 1032	3396	Miro.exe	88
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 3680	3396	Miro.exe	89
PID 3396 wrote to memory of 2288	3396	Miro.exe	90
PID 3396 wrote to memory of 2288	3396	Miro.exe	90
PID 3396 wrote to memory of 1384	3396	Miro.exe	91
PID 3396 wrote to memory of 1384	3396	Miro.exe	91
PID 3396 wrote to memory of 3048	3396	Miro.exe	92
PID 3396 wrote to memory of 3048	3396	Miro.exe	92
PID 3396 wrote to memory of 5096	3396	Miro.exe	93
PID 3396 wrote to memory of 5096	3396	Miro.exe	93
PID 3396 wrote to memory of 3356	3396	Miro.exe	94
PID 3396 wrote to memory of 3356	3396	Miro.exe	94
PID 3396 wrote to memory of 4692	3396	Miro.exe	95
PID 3396 wrote to memory of 4692	3396	Miro.exe	95
PID 3396 wrote to memory of 3020	3396	Miro.exe	97
PID 3396 wrote to memory of 3020	3396	Miro.exe	97
PID 3396 wrote to memory of 4232	3396	Miro.exe	98
PID 3396 wrote to memory of 4232	3396	Miro.exe	98
PID 3396 wrote to memory of 4972	3396	Miro.exe	107
PID 3396 wrote to memory of 4972	3396	Miro.exe	107
PID 3396 wrote to memory of 1804	3396	Miro.exe	108
PID 3396 wrote to memory of 1804	3396	Miro.exe	108
PID 3396 wrote to memory of 1232	3396	Miro.exe	109
PID 3396 wrote to memory of 1232	3396	Miro.exe	109
PID 3396 wrote to memory of 2196	3396	Miro.exe	110
PID 3396 wrote to memory of 2196	3396	Miro.exe	110
PID 3396 wrote to memory of 1684	3396	Miro.exe	111
PID 3396 wrote to memory of 1684	3396	Miro.exe	111
PID 3396 wrote to memory of 2276	3396	Miro.exe	112
PID 3396 wrote to memory of 2276	3396	Miro.exe	112

C:\Users\Admin\AppData\Local\Temp\Miro.exe
"C:\Users\Admin\AppData\Local\Temp\Miro.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:2568
- C:\Users\Admin\AppData\Local\Temp\Miro.exe
  C:\Users\Admin\AppData\Local\Temp\Miro.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\RealtimeBoard /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\RealtimeBoard\Crashpad --url=https://f.a.k/e --annotation=_productName=RealtimeBoard --annotation=_version=0.8.68 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=30.0.2 --initial-client-data=0x510,0x514,0x518,0x504,0x51c,0x7ff6bff30e58,0x7ff6bff30e64,0x7ff6bff30e70
  2⤵
  PID:1032
- C:\Users\Admin\AppData\Local\Temp\Miro.exe
  "C:\Users\Admin\AppData\Local\Temp\Miro.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\RealtimeBoard" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1880,i,8671663099357285833,7525340108430049874,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:3680
- C:\Users\Admin\AppData\Local\Temp\Miro.exe
  "C:\Users\Admin\AppData\Local\Temp\Miro.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\RealtimeBoard" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2176,i,8671663099357285833,7525340108430049874,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  PID:2288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4232
- C:\Users\Admin\AppData\Local\Temp\Miro.exe
  "C:\Users\Admin\AppData\Local\Temp\Miro.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\RealtimeBoard" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --touch-events=enabled --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=3036,i,8671663099357285833,7525340108430049874,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:4972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Users\Admin\AppData\Local\Temp\Miro.exe
  "C:\Users\Admin\AppData\Local\Temp\Miro.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\RealtimeBoard" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features --disable-blink-features --touch-events=enabled --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3448,i,8671663099357285833,7525340108430049874,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:3304
- C:\Users\Admin\AppData\Local\Temp\Miro.exe
  "C:\Users\Admin\AppData\Local\Temp\Miro.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\RealtimeBoard" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features --disable-blink-features --touch-events=enabled --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3508,i,8671663099357285833,7525340108430049874,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:1900
- C:\Users\Admin\AppData\Local\Temp\Miro.exe
  "C:\Users\Admin\AppData\Local\Temp\Miro.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\RealtimeBoard" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features --disable-blink-features --touch-events=enabled --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3440,i,8671663099357285833,7525340108430049874,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:3720
- C:\Users\Admin\AppData\Local\Temp\Miro.exe
  "C:\Users\Admin\AppData\Local\Temp\Miro.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\RealtimeBoard" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features --disable-blink-features --touch-events=enabled --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3504,i,8671663099357285833,7525340108430049874,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
28c65370f12e84b734af87ad491ea257

SHA1
402d3a8203115f1365d48fa72daf0a56e14d8a08

SHA256
4ea873fb3d77a2f8eefae82c943f621f16723516e181bde133568f8f0c91290c

SHA512
56eb34162b0a39da4aaf66aad35ef355a7709982b5060792e3b4849c36650725176e927815537ec58e7ddf0fb1763066b203d6b7f9d1b3dd2c8bc091c0c850cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
2f87410b0d834a14ceff69e18946d066

SHA1
f2ec80550202d493db61806693439a57b76634f3

SHA256
5422bc17b852ad463110de0db9b59ffa4219e065d3e2843618d6ebbd14273c65

SHA512
a313702f22450ceff0a1d7f890b0c16cf667dbcd668dbafa6dbecd0791236c0bc68e834d12113cc75352365c2a2b6cfcf30b6ef7c97ea53ed135da50de389db4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
b7cae91e1fafedfd021b41426ae1b324

SHA1
39d91159f5b846429c393cb71f773dbc5ca2cddc

SHA256
d94091aa57e328c5b7aff2edc51dc9bfcb4b15f06b88e86f51641d100dfb41ca

SHA512
01169c9978fc1d52b35f01dc634999ca0b5c190b3378fc1646fd420b5deefeeacebcdf80ec2d23bbd64f1c3c5055bdadedf37d3c93d80b6b66a55b8d3791cf3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
d0510eaeec723f7f3ad862d9ca9f2231

SHA1
790af0a910a463c97c64325825f446f6d5526fcc

SHA256
410747c5b3da5fddc8996853c373c989fd57802ec243de20625112e8f7c74dc4

SHA512
a945dabdc23b20d4d5dd106d61fa7d38bc0945d0f8fd3159d800f53a8ee5093cb8dd9a2e6d3629b7dfc91e63b689ec40d093c293278dfb95ffca1980746bf190

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
a72ae2e9cc113873fe5a59424a12372d

SHA1
d82d9795405fd9da6f379368f5d1d4d982ec7764

SHA256
83cdbcc472928635d0ff6062abdbfcd514ab61495fc74c548eea02e59162bd3b

SHA512
3cff906ffbbb0fe0cd1c03f1e4729eec86a3a00aab61099e14a9478f3a36fd4e4ee2dc62e9fe43c9b985b404640e757e94919b40b6f90338554a1f298749e86c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ap4slhnm.4kd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\RealtimeBoard\822e9a95-376b-4fcd-a9fb-6fffdfc3e8a6.tmp

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\RealtimeBoard\Network\TransportSecurity

Filesize
1KB

MD5
d0b83d9cd67ba9e973c09367e59038e0

SHA1
27aabacaed971c9ceb7520793a197d8d08c28651

SHA256
6d64d586152b4e9b0fcb07de626b0fcd790856fbaea78e291a3bc15d69668c85

SHA512
e78f5f7efe8a227110d65901fe9f2c7f54a445964887fb1e7331c3f90b81b329cec6b6037c5097ac94852c0245bdbc1061d5b08af2531cc8c607e9d87f3731e5

Download Submit
C:\Users\Admin\AppData\Roaming\RealtimeBoard\Network\TransportSecurity~RFe581623.TMP

Filesize
1KB

MD5
943f9cd36914e0c821426163db654a15

SHA1
567529e86ca4f6aec6281ea5aae76cd22f5b484c

SHA256
bfba79aad7c53ebaaea1d4fa8837d73cde4e7696030641b0e6617fc57a64f33a

SHA512
e21cd93df49c954c8df187244c7a8353cb9d6ec3807e976b1aa6351fed52f8eb5f79fa2211318dc4fb142762e7036929e19f27702c717388bad022be7f931f53

Download Submit
C:\Users\Admin\AppData\Roaming\RealtimeBoard\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\RealtimeBoard\settings.json

Filesize
201B

MD5
dd8d798e719a89d60f6cab00bba8e394

SHA1
a1570b02c3205d2ea80853d0d2c19aa38e152881

SHA256
aa1dbee7ceefbf25248befe3e40bef9ddbac4320b7a2082f55176bd9812ee8ba

SHA512
77ada68d0b316e7794931c55dcb3f4207e1566fdcfc59602a9dcd8b8fc3bde8e5085c39505b0d85b91a5ad993f4da300cb7373c3123540e520ce64a9357a068d

Download Submit
C:\Users\Admin\AppData\Roaming\RealtimeBoard\settings.json

Filesize
283B

MD5
3bb82f62f2ae2eccdc8db2a026c63d28

SHA1
34fb0617a3e76f93fe89aab702ea14b048ecea6e

SHA256
80e7283b4901ceede0b47b71b2f0b750ed84b1aebcd9ef8b9d5b352b1088e38c

SHA512
ea0edd5074952ff824e10d62f4592409637b3bf79bcf0e42d81cf0cba1fdbfb78e5899c24fe225cb2205af67aaea2801100772125ef9d81954705c205e951b24

Download Submit
C:\Users\Admin\AppData\Roaming\RealtimeBoard\settings.json

Filesize
139B

MD5
e7b2933fbfb7f6e4e6114c025500fcee

SHA1
c3c7e3f37b5ef4dc933199c6e660081bee98c2c7

SHA256
bef7467620457cf0aff69b43b97f19ce40a7c104994b874c66bc1195454924ba

SHA512
72061b135929a9fce7437d671e5ea5ac588afe40a3425713ab92a74c2c0d162a5ba5afbeb4614f14e3e7dca31d62f5fdd9aea3e8015eb7c3b6ae909f82d169f7

Download Submit
C:\Users\Admin\AppData\Roaming\RealtimeBoard\settings.json.tmp-163401747373c93c

Filesize
182B

MD5
2a8138d260045691ba83da50e4bedb92

SHA1
e0fcd9e202cccc75a8ad30423909bd71af590052

SHA256
3b39e0204da4d06775de04046416c11d381275b5e29712e5e753af943906bbf3

SHA512
d48813886a2c10b4585509c0da24f8f9ad41aa53b0b9bb7132b86ed0526eb2cc3b1cb16e53a7535a34e926ac52e0afc63844a1267fa2ac2c403e3295d932abd6

Download Submit
C:\Users\Admin\AppData\Roaming\RealtimeBoard\settings.json.tmp-163401789539e5c1

Filesize
221B

MD5
d06446b006cd179794cc818f99268e47

SHA1
64e33416d072eb99f03ac6c8dcfa7d0d2e3a2a55

SHA256
2ce0addd87b732fec8df0982ad05c61b103826065cb33bac52a346a76361c295

SHA512
a47256fb09fb41c93d025ad16c7167a548af11bb73cab274fa20c8f07c905cfa538c928bad244d2670de9c801026470a7e09c5726213e2150fe9828059f8c214

Download Submit
memory/4692-112-0x000001EFFFB10000-0x000001EFFFB86000-memory.dmp

Filesize
472KB

Download
memory/5096-121-0x0000026EF41C0000-0x0000026EF41E4000-memory.dmp

Filesize
144KB

Download
memory/5096-120-0x0000026EF41C0000-0x0000026EF41EA000-memory.dmp

Filesize
168KB

Download
memory/5096-111-0x0000026EF3F70000-0x0000026EF3FB4000-memory.dmp

Filesize
272KB

Download
memory/5096-52-0x0000026EF3B60000-0x0000026EF3B82000-memory.dmp

Filesize
136KB

Download