mercurialgrabber | hxxps://github[.]com/adadasd23/Solara-download/blob/main/KiansNudes[.]exe | Triage

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2024 19:58

Sharing

Report Analysis Logs

General

Target

https://github.com/adadasd23/Solara-download/blob/main/KiansNudes.exe

Score

10^/10

mercurialgrabber credential_access discovery evasion persistence spyware stealer

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/1266017394384568320/R76AJKG6HGOrLxC8nIYOmvPNY0ib82aEEpSlIAW1Ms9HACpDgbTieAQ9vBYjz3LP3vXY

Signatures

Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
stealer mercurialgrabber
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	KiansNudes.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SolaraInstaller.exe

Downloads MZ/PE file

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	KiansNudes.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	SolaraInstaller.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	KiansNudes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SolaraInstaller.exe

Executes dropped EXE 2 IoCs

pid	Process
2020	KiansNudes.exe
5672	SolaraInstaller.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mercurial Grabber = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\KiansNudes.exe\""	KiansNudes.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

flow	ioc
73	discord.com
120	discord.com
54	raw.githubusercontent.com
55	raw.githubusercontent.com
81	discord.com
82	discord.com
119	discord.com
121	discord.com
123	discord.com
74	discord.com
77	discord.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
70	ip-api.com
79	ip4.seeip.org
67	ip4.seeip.org
68	ip4.seeip.org

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SolaraInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	SolaraInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	KiansNudes.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	KiansNudes.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 2 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	KiansNudes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	SolaraInstaller.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	KiansNudes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	KiansNudes.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SolaraInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SolaraInstaller.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	SolaraInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	KiansNudes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	KiansNudes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	KiansNudes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	SolaraInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	SolaraInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	SolaraInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	KiansNudes.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 317862.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 818934.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\KiansNudes.exe\:SmartScreen:$DATA	KiansNudes.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2760	msedge.exe
2760	msedge.exe
4376	msedge.exe
4376	msedge.exe
1180	identity_helper.exe
1180	identity_helper.exe
2300	msedge.exe
2300	msedge.exe
5564	msedge.exe
5564	msedge.exe
2020	KiansNudes.exe
2020	KiansNudes.exe
5628	msedge.exe
5628	msedge.exe
5628	msedge.exe
5628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	KiansNudes.exe
Token: SeDebugPrivilege	5672	SolaraInstaller.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 2832	4376	msedge.exe	84
PID 4376 wrote to memory of 2832	4376	msedge.exe	84
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2876	4376	msedge.exe	85
PID 4376 wrote to memory of 2760	4376	msedge.exe	86
PID 4376 wrote to memory of 2760	4376	msedge.exe	86
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87
PID 4376 wrote to memory of 1556	4376	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/adadasd23/Solara-download/blob/main/KiansNudes.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf4d346f8,0x7ffcf4d34708,0x7ffcf4d34718
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300
- C:\Users\Admin\Downloads\KiansNudes.exe
  "C:\Users\Admin\Downloads\KiansNudes.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5564
- C:\Users\Admin\Downloads\SolaraInstaller.exe
  "C:\Users\Admin\Downloads\SolaraInstaller.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,10510113834220391313,393773967059536517,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2720 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d061ff23fcd3c348c9baca5de95122f3

SHA1
ecc98e19b205313bd9e5b0fad1a079e5ac984472

SHA256
c45f622a53f870178b43338bf6185af0f01d6dddc61b2d84bb1f040a93188c9e

SHA512
d995bd6f2d49edfcdc1a80d740774606ef48de6aff77ad69c0ebcb47d78ccd9fb8a4f122f6935de29f9fd83609d9e8ae44817cd6db35cf512432ab63a9dc4255

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
ed5f4213c17629776cd75510648fc019

SHA1
ebfa685dca9b7c920cd5ad521c03e4ad0ce435b9

SHA256
e969795f0e63ec8a35cdf34d5bc43867ca0825bebfed9734943e69b34ed2ad87

SHA512
71bcc166ae5a48f7a79aa5de7ecc7e10dce22c39240ca9ffe9d0f9340f40fc2a2429529cfee8b2b5d7082efe94921fa7df3454852d5313ff4093bfdffc189627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1ec26186431a9e6d4857c953d816c170

SHA1
7d49ca43355b76400af374b899fbc880690cbb2d

SHA256
0fa94022aa30958e9a1a42974282419e1302a223d29343b346523f874db5f4d4

SHA512
aecc9175e75f71d51a141a6ea6ee395ba00472d8069aa95a02ca9fb3be944c80896fa8d78c21e62140130dee0c092298f7182aad6d93685859102170c24ee7de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
35fc94c27ed9ae5a3655c8cd9d76efcb

SHA1
f383ad8316f75fffe75b1693f47d9183048f3221

SHA256
80260f5eb1cee234e5ccd3169f5851cb19547b32c5f5ee08ce56c35444c58a7c

SHA512
7867807d1a83272fd7e4b6ad94e6559f9ae3d8bafd4aec12b22f356e6d5ffd10c2aa99c322fa4c7e70b83ccc0763e50524086fb41a951dc7343277ecd7e4c0ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d70b147b5b8de0f88b9844d637976963

SHA1
8d6a7da9d76fbe50e8d0833d53e303f8d606d016

SHA256
82ff27c62db3e57cf588d0ad891830f1a5e6f60ae0b7dd4b77a5b70be558585f

SHA512
7bfec30585e735012b67f1ae01ac983d3d53cacc0d87fecfe8d3b0096f6a18dcef649b7e4e14a02897258ad04b797250de3c8ac0f5b08163e2892df40abd5d10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1018B

MD5
a03f69fb70d0db0368befd805ed7bb35

SHA1
8a7ac6f53a4c0874cb56bf5ab2a1559e3206fc0d

SHA256
831daf726b7d3e78ff0cbf846e05e242c47c16823d729d310eb50444ef56872c

SHA512
d9e4b8793e277de345a29e9f3fe331093763734ef6f481d7be46f752306c64fd777b6fa2fa828ff4b0c9b1ff63de8693ba7481da39cbd94191647d9795b2bfb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f695.TMP

Filesize
1018B

MD5
40c93b5447dbad9ab8ece9241f62f239

SHA1
e55fd376a45e476d22599b52b12907a0e27d2d7b

SHA256
6d72824a4b71194c9ad7fa7b012941ea6fe08fc4cb7368295213481cbfc91cab

SHA512
85e48c9c58697e02390012dc199fb19be82bc75be63e74c3641a136d73e09d938f16a021532d60856743c1094c0f4cdf0487a825f556bce996c7bce343c05c53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e98a33c2c0d7ad0141e0e3829d1976c5

SHA1
ddd0838cc54efbf774446f4c33f4aeaa043f3330

SHA256
23ae0eb7fcafe12b533c024ada40796929633df9e842441284ed2e5f93860225

SHA512
30071c9cd47a33e5de9bbf2d649349bd3636d34434ede4dcf42620c8b79602900c0d19450c1cf90aa0e684c7b6a3b8e7bf59ecf36129ff3966b241325531b4b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
122fae438907964ecd9cf2a2ac9d7f13

SHA1
20f1fd1c8ac6b40c2cf09ef859853148d9722673

SHA256
8da1cc5a57ef02b51c19fd553562389ee6aa86d244e7ac08d749c321ea2d35f5

SHA512
652c0148efa7563a90299c4a0dbd69be17168ac91f60c31386370c7d78b5ea1499e81e51b74f1414dfc23c7b1ffa77056dffbc304cc031541ad02368728c1228

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 317862.crdownload

Filesize
42KB

MD5
b82bab314eca300f8efef9c32ea307dd

SHA1
040606e0e595a71c10582eec0471c9fa795c8670

SHA256
1f915f0c62782b129588f54ea7aacdd8186c06ad1f3657c9bca9e215946ff09f

SHA512
20bf89a1721a44e99ae80edd9f39e90cc453f4b3234c830d8f316aaddfc82de1a2b2a7011760409f547bd30925eda9923831fbcee38cd96ee5d69ac1cefff532

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 818934.crdownload

Filesize
42KB

MD5
fb13dd70a958aedc31258d420fe041dc

SHA1
9ffec9cd2ca4376dbb76c11d01a399c56322bce9

SHA256
bbbb5c3c43dc7ff7a744535c1e5cd369bfae7e99db65bdb56453ee373749b23b

SHA512
9efba8591ffd45974ffefaa437b0ae241f8c0183bdc73a8b83618578e955fef61a756dac196da052e6580fd72d602de4990d528e96f798ffbc33f3bfa04bb57d

Download Submit
memory/2020-194-0x0000000000D60000-0x0000000000D70000-memory.dmp

Filesize
64KB

Download
memory/5672-243-0x0000000000550000-0x0000000000560000-memory.dmp

Filesize
64KB

Download