azorult | 9a227f47f09d34808e5ccf5856bf8900ae72fdc777d1d9e51de3d3a9ada0ef25

Resubmissions

14-08-2024 06:06

240814-gtrf8sxgpe 10

14-08-2024 06:00

240814-gqmnwaxglc 10

Analysis

max time kernel
3s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e83ed2446c4dcaea4dee212911c60040N.exe
Size

2.0MB
MD5

e83ed2446c4dcaea4dee212911c60040
SHA1

939997535659c10cbf9aee8203466745475a1b69
SHA256

9a227f47f09d34808e5ccf5856bf8900ae72fdc777d1d9e51de3d3a9ada0ef25
SHA512

51b6d85dc84bf0f9df1f63f2e1ea76806fc4c7b9d96e928645d485bcc7b369fb4a7d49d7cccb286b4c483b3ae1ac8a6ab14a25503a2615059134a84c362aa9ff
SSDEEP

24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYr:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Y9

Score

10^/10

azorult quasar ebayprofiles discovery infostealer spyware trojan

Malware Config

Extracted

Family

azorult

http://0x21.in:8000/_az/

Extracted

Family

quasar

Version

1.3.0.0

Botnet

EbayProfiles

5.8.88.191:443

sockartek.icu:443

Mutex

QSR_MUTEX_0kBRNrRz5TDLEQouI0

Attributes

encryption_key
MWhG6wsClMX8aJM2CVXT
install_name
winsock.exe
log_directory
Logs
reconnect_delay
3000
startup_key
win defender run
subdirectory
SubDir

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\windef.exe	family_quasar
behavioral1/memory/3380-29-0x0000000000C40000-0x0000000000C9E000-memory.dmp	family_quasar
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e83ed2446c4dcaea4dee212911c60040N.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	e83ed2446c4dcaea4dee212911c60040N.exe

Executes dropped EXE 3 IoCs

Processes:

vnc.exewindef.exewinsock.exe

pid process

4268 vnc.exe
3380 windef.exe
2020 winsock.exe

pid	process
4268	vnc.exe
3380	windef.exe
2020	winsock.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e83ed2446c4dcaea4dee212911c60040N.exe

description	ioc	process
File opened (read-only)	\??\i:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\o:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\v:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\x:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\e:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\g:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\j:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\k:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\l:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\n:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\p:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\r:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\z:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\a:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\b:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\h:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\q:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\t:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\m:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\s:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\u:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\w:	e83ed2446c4dcaea4dee212911c60040N.exe
File opened (read-only)	\??\y:	e83ed2446c4dcaea4dee212911c60040N.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

75 sites.google.com
78 sites.google.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 ip-api.com

flow	ioc
75	sites.google.com
78	sites.google.com

flow	ioc
11	ip-api.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e83ed2446c4dcaea4dee212911c60040N.exe

description pid process target process

PID 1336 set thread context of 5012 1336 e83ed2446c4dcaea4dee212911c60040N.exe e83ed2446c4dcaea4dee212911c60040N.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4012 4268 WerFault.exe vnc.exe
5532 2020 WerFault.exe winsock.exe
1472 4752 WerFault.exe vnc.exe

description	pid	process	target process
PID 1336 set thread context of 5012	1336	e83ed2446c4dcaea4dee212911c60040N.exe	e83ed2446c4dcaea4dee212911c60040N.exe

pid	pid_target	process	target process
4012	4268	WerFault.exe	vnc.exe
5532	2020	WerFault.exe	winsock.exe
1472	4752	WerFault.exe	vnc.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

windef.exeschtasks.exeschtasks.exewinsock.exee83ed2446c4dcaea4dee212911c60040N.exevnc.exee83ed2446c4dcaea4dee212911c60040N.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winsock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e83ed2446c4dcaea4dee212911c60040N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e83ed2446c4dcaea4dee212911c60040N.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

5560 PING.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5560 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

6080 schtasks.exe
5324 schtasks.exe
1012 schtasks.exe
4084 schtasks.exe
372 schtasks.exe

pid	process
5560	PING.EXE

pid	process
5560	PING.EXE

pid	process
6080	schtasks.exe
5324	schtasks.exe
1012	schtasks.exe
4084	schtasks.exe
372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e83ed2446c4dcaea4dee212911c60040N.exe

pid	process
1336	e83ed2446c4dcaea4dee212911c60040N.exe
1336	e83ed2446c4dcaea4dee212911c60040N.exe
1336	e83ed2446c4dcaea4dee212911c60040N.exe
1336	e83ed2446c4dcaea4dee212911c60040N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

windef.exewinsock.exe

description pid process

Token: SeDebugPrivilege 3380 windef.exe
Token: SeDebugPrivilege 2020 winsock.exe

description	pid	process
Token: SeDebugPrivilege	3380	windef.exe
Token: SeDebugPrivilege	2020	winsock.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

e83ed2446c4dcaea4dee212911c60040N.exevnc.exewindef.exe

description	pid	process	target process
PID 1336 wrote to memory of 4268	1336	e83ed2446c4dcaea4dee212911c60040N.exe	vnc.exe
PID 1336 wrote to memory of 4268	1336	e83ed2446c4dcaea4dee212911c60040N.exe	vnc.exe
PID 1336 wrote to memory of 4268	1336	e83ed2446c4dcaea4dee212911c60040N.exe	vnc.exe
PID 4268 wrote to memory of 3684	4268	vnc.exe	svchost.exe
PID 4268 wrote to memory of 3684	4268	vnc.exe	svchost.exe
PID 1336 wrote to memory of 3380	1336	e83ed2446c4dcaea4dee212911c60040N.exe	windef.exe
PID 1336 wrote to memory of 3380	1336	e83ed2446c4dcaea4dee212911c60040N.exe	windef.exe
PID 1336 wrote to memory of 3380	1336	e83ed2446c4dcaea4dee212911c60040N.exe	windef.exe
PID 4268 wrote to memory of 3684	4268	vnc.exe	svchost.exe
PID 1336 wrote to memory of 5012	1336	e83ed2446c4dcaea4dee212911c60040N.exe	e83ed2446c4dcaea4dee212911c60040N.exe
PID 1336 wrote to memory of 5012	1336	e83ed2446c4dcaea4dee212911c60040N.exe	e83ed2446c4dcaea4dee212911c60040N.exe
PID 1336 wrote to memory of 5012	1336	e83ed2446c4dcaea4dee212911c60040N.exe	e83ed2446c4dcaea4dee212911c60040N.exe
PID 1336 wrote to memory of 5012	1336	e83ed2446c4dcaea4dee212911c60040N.exe	e83ed2446c4dcaea4dee212911c60040N.exe
PID 1336 wrote to memory of 5012	1336	e83ed2446c4dcaea4dee212911c60040N.exe	e83ed2446c4dcaea4dee212911c60040N.exe
PID 1336 wrote to memory of 1012	1336	e83ed2446c4dcaea4dee212911c60040N.exe	schtasks.exe
PID 1336 wrote to memory of 1012	1336	e83ed2446c4dcaea4dee212911c60040N.exe	schtasks.exe
PID 1336 wrote to memory of 1012	1336	e83ed2446c4dcaea4dee212911c60040N.exe	schtasks.exe
PID 3380 wrote to memory of 4084	3380	windef.exe	schtasks.exe
PID 3380 wrote to memory of 4084	3380	windef.exe	schtasks.exe
PID 3380 wrote to memory of 4084	3380	windef.exe	schtasks.exe
PID 3380 wrote to memory of 2020	3380	windef.exe	winsock.exe
PID 3380 wrote to memory of 2020	3380	windef.exe	winsock.exe
PID 3380 wrote to memory of 2020	3380	windef.exe	winsock.exe

C:\Users\Admin\AppData\Local\Temp\e83ed2446c4dcaea4dee212911c60040N.exe
"C:\Users\Admin\AppData\Local\Temp\e83ed2446c4dcaea4dee212911c60040N.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1336

C:\Users\Admin\AppData\Local\Temp\vnc.exe
"C:\Users\Admin\AppData\Local\Temp\vnc.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k
3⤵
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 548
3⤵
- Program crash
PID:4012

C:\Users\Admin\AppData\Local\Temp\windef.exe
"C:\Users\Admin\AppData\Local\Temp\windef.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f
3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4084

C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe
"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f
4⤵
- Scheduled Task/Job: Scheduled Task
PID:372

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fJsfjSo5DElM.bat" "
4⤵
PID:5456

C:\Windows\SysWOW64\chcp.com
chcp 65001
5⤵
PID:5524

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5560

C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe
"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"
5⤵
PID:6012

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f
6⤵
- Scheduled Task/Job: Scheduled Task
PID:6080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 2224
4⤵
- Program crash
PID:5532

C:\Users\Admin\AppData\Local\Temp\e83ed2446c4dcaea4dee212911c60040N.exe
"C:\Users\Admin\AppData\Local\Temp\e83ed2446c4dcaea4dee212911c60040N.exe"
2⤵
- System Location Discovery: System Language Discovery
PID:5012

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F
2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4268 -ip 4268
1⤵
PID:700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:2480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x78,0x128,0x7ffc33b646f8,0x7ffc33b64708,0x7ffc33b64718
2⤵
PID:4200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11716377592285128169,17622970960963773545,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1488 /prefetch:2
2⤵
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,11716377592285128169,17622970960963773545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
2⤵
PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,11716377592285128169,17622970960963773545,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
2⤵
PID:3892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11716377592285128169,17622970960963773545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
2⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11716377592285128169,17622970960963773545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11716377592285128169,17622970960963773545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
2⤵
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11716377592285128169,17622970960963773545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
2⤵
PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11716377592285128169,17622970960963773545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3580 /prefetch:8
2⤵
PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11716377592285128169,17622970960963773545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3580 /prefetch:8
2⤵
PID:1252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11716377592285128169,17622970960963773545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
2⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11716377592285128169,17622970960963773545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
2⤵
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11716377592285128169,17622970960963773545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
2⤵
PID:5192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11716377592285128169,17622970960963773545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
2⤵
PID:5760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11716377592285128169,17622970960963773545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
2⤵
PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11716377592285128169,17622970960963773545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
2⤵
PID:5924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11716377592285128169,17622970960963773545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
2⤵
PID:624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11716377592285128169,17622970960963773545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
2⤵
PID:3000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2020 -ip 2020
1⤵
PID:5492

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe
1⤵
PID:3472

C:\Users\Admin\AppData\Local\Temp\vnc.exe
"C:\Users\Admin\AppData\Local\Temp\vnc.exe"
2⤵
PID:4752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k
3⤵
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 520
3⤵
- Program crash
PID:1472

C:\Users\Admin\AppData\Local\Temp\windef.exe
"C:\Users\Admin\AppData\Local\Temp\windef.exe"
2⤵
PID:5144

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe
"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"
2⤵
PID:2396

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F
2⤵
- Scheduled Task/Job: Scheduled Task
PID:5324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4752 -ip 4752
1⤵
PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\windef.exe.log

Filesize
1KB

MD5
10eab9c2684febb5327b6976f2047587

SHA1
a12ed54146a7f5c4c580416aecb899549712449e

SHA256
f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928

SHA512
7e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f1235fa79b01d36b32243eee3814950

SHA1
dc8f4017bf06e869684f4405bb30bcae97a58fa4

SHA256
bd3b855de36dd14ba25f82efa819d80d833df57bf4eec487cba76d367f634b68

SHA512
6d9360166b79f435d76fd8912b24bcddf03f207b5de6f5099518acc831443052241eafb8a385a3deb42a2e0a95ee91862d41a0b6544b57115835468841b4c88f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa47954e07c7176a4bf3d033a7b52f8b

SHA1
8e715fe790d98fcaeb7b79071d6555b1b66d9c73

SHA256
c170046cc3fcee098049fe605aeeccc134b808c76f9a758242cda2d799080b0c

SHA512
c3d1aa79719744779dd2aca71e07f8939af394d7e57ae86819470ce3f91ac4b19824e1d1f10bd6f35d44e282bd7f6a81e7c8685b563cef06d0416f6583157844

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f3c64cc56a09403da72b75b3b678ad0

SHA1
81808724ded6b964302a0429e8fadccc4c253312

SHA256
92267902563e8a20238fa683c684c8ba48072036db9631483a909fc82fcaa087

SHA512
cce76d0e1fcb0c4c537b0b10de6ac2fbd1d932b6a4d7ae564b10184b736f7243a025df2c4b0db28d47640e123b08e7457eb87a14026fe8c5f3ea18a628c5aa5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c00d0c3c-2ecc-4d62-a2fc-578fc1a6f7b8.tmp

Filesize
11KB

MD5
8c3e768715381db284cc701c50e1ae48

SHA1
0d76430444b9a6c1c7a024a7820058e31199eb2e

SHA256
ff8dd37cc1d815fedc30f0f68611af002f9695b0306799086e086e69abe9e24f

SHA512
2fc49c690a80b905f65efac1b67dc4fc9c517fb5697b281cf3cf6fc1f183a6242eaa3fac4e73627c3da96cb20732f3e511c2b768ccc7caa4f3987ff0b18e36ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\fJsfjSo5DElM.bat

Filesize
208B

MD5
b0f4a8bbb435da969896a307a5a1ce0f

SHA1
1d042ece439442825560e1e53e9145121e9de063

SHA256
95ff53378c2e6f16e750797b570c00c19a222da104c7e152c41d5cf4d6a0c027

SHA512
07a4e5740a7a461e933ab8f8156185d5deace796baa7ef0b2bb9c555b54a0a2284aa3076a9d5ced04044e480de22d8dcb5b4c79a6786780b3c95e73e89dab68f

Download Submit
C:\Users\Admin\AppData\Local\Temp\vnc.exe

Filesize
405KB

MD5
b8ba87ee4c3fc085a2fed0d839aadce1

SHA1
b3a2e3256406330e8b1779199bb2b9865122d766

SHA256
4e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4

SHA512
7a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2

Download Submit
C:\Users\Admin\AppData\Local\Temp\windef.exe

Filesize
349KB

MD5
b4a202e03d4135484d0e730173abcc72

SHA1
01b30014545ea526c15a60931d676f9392ea0c70

SHA256
7050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9

SHA512
632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\08-14-2024

Filesize
368B

MD5
4172fe81fc7de1f75c28f5a2bc5dc7af

SHA1
c47ac7bfebf2bf4580a1637de69afc4676830f3d

SHA256
bd928fa724a0896c0f804baced5cb716c7b9b6aec8ec954daff24ef432d07516

SHA512
f3840b9b9b41757e08c435470b1b4a8dd312e9f43b01774b092f57d754a4af0e9b7779a17cf13b7430ba0afa338a822e17c466648283c63a3a2c9ea69d6f8672

Download Submit
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

Filesize
2.0MB

MD5
dd6f5f1e7c6d71198efe1a73f17c7140

SHA1
9dfd3674fb6c56d8535f9a28091427861d66fbe9

SHA256
260e9fdb1d9e6f24c1776879c53c6826aa61e6c8438778a5ead27050526d6d36

SHA512
869748b63bbd9b037eb3c685bf7164ee0ed72dd3943b917aeabaada9be51eada9790543f1a8d20e56c162ebeb1d08e496ed29c322d96b6ad93aa1c94a571bf19

Download Submit
\??\pipe\LOCAL\crashpad_2480_VHGZXBRRZWEKZHSP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1336-24-0x0000000003E20000-0x0000000003E21000-memory.dmp

Filesize
4KB

Download
memory/2020-44-0x00000000064A0000-0x00000000064AA000-memory.dmp

Filesize
40KB

Download
memory/3380-36-0x00000000067C0000-0x00000000067FC000-memory.dmp

Filesize
240KB

Download
memory/3380-35-0x0000000006280000-0x0000000006292000-memory.dmp

Filesize
72KB

Download
memory/3380-34-0x00000000056A0000-0x0000000005706000-memory.dmp

Filesize
408KB

Download
memory/3380-33-0x0000000005600000-0x0000000005692000-memory.dmp

Filesize
584KB

Download
memory/3380-32-0x0000000005BB0000-0x0000000006154000-memory.dmp

Filesize
5.6MB

Download
memory/3380-29-0x0000000000C40000-0x0000000000C9E000-memory.dmp

Filesize
376KB

Download
memory/5012-28-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5012-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download