nanocore | 5e7118d4d85c86fe2f3b98541694f1fcecb4cfc3c5de57ba2e9fffed7335a41f

Resubmissions

05/08/2024, 18:52

240805-xjempavemr10

05/08/2024, 18:51

240805-xhhyqayejf10

Analysis

max time kernel
50s
max time network
52s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05/08/2024, 18:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
waveTool.exe
Size 544KB
Sample240805-xjempavemr
SHA256 5e7118d4d85c86fe2f3b98541694f1fcecb4cfc3c5de57ba2e9fffed7335a41f
MD5 a1d84d4f688025921352cd3d9f100461
SHA1 6d905fa87c926af0ba5ded4b6585417449fc5b1a
SHA512 2a492172d3db0669eff0ac8c1f358638c38578c72d1311e3a80d3614d969728187c62643e0b53956f8cd86adf2d2383d91e74d51234f5c2f5cbde32a80a77ee6
SSDEEP 12288:2QnZ4kCDyG3HvxPUHLoSOaKjCObx3DXHcvPX1KeE9YJ:9nZ4kCTPxhDEOFzHc3X0eZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

127.0.0.1:54984

Mutex

c2061050-265f-4002-913c-ea1f49d7f810

Attributes

activate_away_mode
false
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2024-05-17T20:07:09.307958536Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
3814
connection_port
54984
default_group
Default
enable_debug_mode
false
gc_threshold
1.048576e+07
keep_alive_timeout
29991
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
c2061050-265f-4002-913c-ea1f49d7f810
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
127.0.0.1
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
4997
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 656 set thread context of 2320	656	waveTool.exe	82

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	waveTool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	waveTool.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1448	msedge.exe
1448	msedge.exe
2880	msedge.exe
2880	msedge.exe
3500	msedge.exe
3500	msedge.exe
1996	identity_helper.exe
1996	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 2320	656	waveTool.exe	82
PID 656 wrote to memory of 2320	656	waveTool.exe	82
PID 656 wrote to memory of 2320	656	waveTool.exe	82
PID 656 wrote to memory of 2320	656	waveTool.exe	82
PID 656 wrote to memory of 2320	656	waveTool.exe	82
PID 2320 wrote to memory of 2880	2320	waveTool.exe	83
PID 2320 wrote to memory of 2880	2320	waveTool.exe	83
PID 2880 wrote to memory of 4824	2880	msedge.exe	84
PID 2880 wrote to memory of 4824	2880	msedge.exe	84
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1192	2880	msedge.exe	85
PID 2880 wrote to memory of 1448	2880	msedge.exe	86
PID 2880 wrote to memory of 1448	2880	msedge.exe	86
PID 2880 wrote to memory of 4036	2880	msedge.exe	87
PID 2880 wrote to memory of 4036	2880	msedge.exe	87
PID 2880 wrote to memory of 4036	2880	msedge.exe	87
PID 2880 wrote to memory of 4036	2880	msedge.exe	87
PID 2880 wrote to memory of 4036	2880	msedge.exe	87
PID 2880 wrote to memory of 4036	2880	msedge.exe	87
PID 2880 wrote to memory of 4036	2880	msedge.exe	87
PID 2880 wrote to memory of 4036	2880	msedge.exe	87
PID 2880 wrote to memory of 4036	2880	msedge.exe	87
PID 2880 wrote to memory of 4036	2880	msedge.exe	87
PID 2880 wrote to memory of 4036	2880	msedge.exe	87
PID 2880 wrote to memory of 4036	2880	msedge.exe	87
PID 2880 wrote to memory of 4036	2880	msedge.exe	87

C:\Users\Admin\AppData\Local\Temp\waveTool.exe
"C:\Users\Admin\AppData\Local\Temp\waveTool.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:656
- C:\Users\Admin\AppData\Local\Temp\waveTool.exe
  "C:\Users\Admin\AppData\Local\Temp\waveTool.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=waveTool.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaa8c73cb8,0x7ffaa8c73cc8,0x7ffaa8c73cd8
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,6241552398550305699,5411898606094257014,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,6241552398550305699,5411898606094257014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,6241552398550305699,5411898606094257014,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
      4⤵
      PID:4036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,6241552398550305699,5411898606094257014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,6241552398550305699,5411898606094257014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
      4⤵
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,6241552398550305699,5411898606094257014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
      4⤵
      PID:1256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,6241552398550305699,5411898606094257014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,6241552398550305699,5411898606094257014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
      4⤵
      PID:2344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,6241552398550305699,5411898606094257014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,6241552398550305699,5411898606094257014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
      4⤵
      PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,6241552398550305699,5411898606094257014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,6241552398550305699,5411898606094257014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1848,6241552398550305699,5411898606094257014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,6241552398550305699,5411898606094257014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=waveTool.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaa8c73cb8,0x7ffaa8c73cc8,0x7ffaa8c73cd8
      4⤵
      PID:2032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e9784fcff01f83f4925f23e3a24bce63314ea503c2091f7309c014895fead33c
MD5 2ee16858e751901224340cabb25e5704
SHA1 24e0d2d301f282fb8e492e9df0b36603b28477b2
SHA512 bd9994c2fb4bf097ce7ffea412a2bed97e3af386108ab6aab0df9472a92d4bd94489bb9c36750a92f9818fa3ea6d1756497f5364611e6ebd36de4cd14e9a0fba
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9e7e47ebf490ba409eab3be0314fa695bf28f4764f4875c7568a54337f2df70f
MD5 ea667b2dedf919487c556b97119cf88a
SHA1 0ee7b1da90be47cc31406f4dba755fd083a29762
SHA512 832391afcac34fc6c949dee8120f2a5f83ca68c159ff707751d844b085c7496930f0c8fd8313fd8f10a5f5725138be651953934aa79b087ba3c6dd22eaa49c72
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 b636958fb3cdf05189da8e1e17c66c7b5f3cb9e26ab3df5be31ba3f243644a2a
MD5 441f9ba0827fb5e830a415e42989b249
SHA1 0e7dc3a9e719a30e90b2a1c76aa6ad25ce2df179
SHA512 93bf18382e34a6724a16d03429e25ca99f3157ab2e4d73a928a8e2ff80f50caa2bfaaec81732326a880246ff324ecaaeb029b117a9e3f925abb1c0da175d3c6a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e3f026bbc2c29284014dde89850d4ea5bab3a467c08becd228a9f2a6adb35bef
MD5 3bc53a2f9a7357659d0c7cc0e19ea601
SHA1 413e515532869c4f07e71a5ce4974c2c0afb1f22
SHA512 598f6c2240b926998c345e70dd15c0be7d10d859a8da21baf8125548e36efe0448ecd43569fb639b395f74999b8f7a589eeeaac840621c26e264c864f221962c
SSDEEP 96:nZ5k3tfpVeKkBcEwSv0MoiVmdHIskJf6h0WQyV+VpziX3wI3:nfk3tH5kBDv0MAIsi6Lx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 62d08b8a484c3c329dccda73f9e8fd42f2f1ec25cb5723bc458520f70758e363
MD5 e160bf72e77e071b34b48589e64e73cf
SHA1 084a65258c8d8146d9083fa70bfab9dd2d397716
SHA512 967ab8309bfc88fe010867a0babdb3c3d65be83435bdf8cc0646f36591e14cb6e3d6c202ccf06126caa7618b0444b0a529b32d85380f1e4287941d494bd08462
SSDEEP 96:nZ5kG/OpVeKk6cEwSv0MoiVmd1XOY9C4MkdfmOp5saRJw62i0WQyV+VpAiX3wI3:nfkg+5k6Dv0MHYk4BdXs4vLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3bef3713d941ad5c46a5f0d62bd93659bb8409059057a718111435af2e1f79ac
MD5 47df43239283b8dfa4a2baaa12377365
SHA1 f2a3529dd25bdf6843aeeb45871892cba8a51fa0
SHA512 e0db5026f0ad061af46cac0f7b5e0127ba4e6aea12d84267ef3903495869f416f719373f4992e04be08f323409489ac93af424833534ae49911cd47beea7967e
SSDEEP 96:nZ5k3tOpVeKk6cEwSv0MoiVmd1XOY9C4MkdfmOp5saRJf62i0WQyV+VpAiX3wI3:nfk3t+5k6Dv0MHYk4BdXs4GLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 824f1c4beadde2fb8aa7249b87ee34f7fda98bd790654e4ce3e61e40e25717e0
MD5 68ac216c0d363a7b251009b1003e31d9
SHA1 6f249d2161b420de8c7726438a9f7c997911ca2b
SHA512 34069f24d5d90a1539bcfb204646a9ab84b56b846263f8f2ebcda90adda0c4ec2d159082e5705d239492675d3062187cb9b131ddda242a8193bcda9160cc7133
SSDEEP 96:nZ5kCMpVeKkycEwSv0MoidoROmd12tk4EOfmOp5s9J962XF0WQyV+VpAiX3wI3:nfkz5kyDv0Mmctk4XdXsnDLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 367B
SHA256 1b117cfae4fae1b2044af5e783838c09f52b5b2519c2790beafc2d935fb990f5
MD5 63a526218190fb81c204f1da193890e2
SHA1 c55d9274dd1dc1bf1e859ff9c29532d255b3c05e
SHA512 b1cad5673bcf82545351e2014830815d23cf63ddd353e9e24724c845ec7aae0c98be3d70e3a3b72c26e771296fcfe1ef7e148c1c27898d8c42ddb70599b28308
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 367B
SHA256 f358c2886d8d112db8e3ec1189ee46f3dfef12675e321d45e710f3c5c98bdd33
MD5 83b5205d0e41976f5a0dd258d02164b9
SHA1 69ff236b620102616c7c5b0375e68e63443a52e4
SHA512 7bcf93b5f8263479aff3109c60dd7f792cb144ebb449a75720c7ea78178e6e5b027b7ee68ce5433db0a6880cca3ff2ea1c1ab45d8597ada2e1b2b0d78dbbb214
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5810d4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5810d4.TMP
Size 367B
SHA256 a8e9ccb1e03c6cb5f4fd7d9e434074a16744dc5cac65d0fe9c0c047e6eb04ddb
MD5 786176791f47d673611e114fb146e19d
SHA1 e5daabfe139a4241ca66b5ba0a302abd8fdcdc3b
SHA512 f830f53b51d7a68fd147712b96664e56bce430c573bd544787cb2abb8eda6fccfb1a8b5971b5fb91b18bff6d385f74662ffa29b249beef97e65c8f3cebef6494
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f9065e4658b9c93618e4311aad2dbc65dfff925db2ea35bf41639526a507fc2f
MD5 68e80fc24c31815e3e6ea5b9236b2353
SHA1 cd7844b3a1262bf9f411c2f65a7b8a0736fde6a7
SHA512 fee7b7848ee5b52da824c1bf5a9568484baa0741a83666b55cacadba3e5948ce91ebe43d94a3803ee2b1ad5ebb9b81b64bbe3187e914e7e6a98eb9db523b7172
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGYbK3e2RUCQSO5kdQQHO0x0pk:M9iIxuERzA83h09RZxASGYO/7QLkdQVM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2b25ba2d4781f63a12568656ee6f7279bddabd5ccb29f95bf656463b70a4aaf1
MD5 12f1d8cd62944fb93b8097a3b0f18586
SHA1 4f080c8b5bffb659f32d4c4e0319042b7abadf05
SHA512 521a674dc1e0aa0b4f445f3346d84ec3873b31612f3d3528700fb189bee6c5d8fbf71e8b12256e3c77adf83eda995597d25c0477720e9e04226b5745fde86c4a
SSDEEP 192:qoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGHK3e2RUB0CSO5kwQQHO0x0pk:u9iIxuERzA83h09RZxASGq/G0CLkwQVM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 984392432d3f79afcde7ab17523c202f55b533536cc6bb1c81c887daeeeee64f
MD5 4781401e84933236d0fad7881251ada6
SHA1 a72778dbb8cc86e1ad0b52508651573a28bd62b5
SHA512 bae3f7ed4e0c0ecf9d264ff2ffd38793f7628b4c7fd7a7a0f61ff8e1898595bd26c3e8e4b98b84b407b2b58239b990c59fca65590c75e6877b089dd226bd5f1d
SSDEEP 192:MoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGHK3e2RUCQSO5kQQQHO0x0pOZ:89iIxuERzA83h09RZxASGq/7QLkQQV0J
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/656-1-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2320-0-0x0000000000400000-0x0000000000490000-memory.dmp

Download