fickerstealer | e82b6dbff7c4257eefb6e78e4ded3a295de8f2e31a77e7fcc311af233ea3d52a

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
16-08-2024 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

view.html
Size

87KB
MD5

46c0c6964ceb25bb8387310ad164a5dc
SHA1

cd9304259e9707609dc193eb3b4625f713d59ed5
SHA256

e82b6dbff7c4257eefb6e78e4ded3a295de8f2e31a77e7fcc311af233ea3d52a
SHA512

9dbb9098b61f832d8b793d4d04c3ff7dea7cb18c91757aef672e6564809481167bb49ef55546cd701686e6fb8b071c8cfa5fb007699f1d09d1ff77988c2b4334
SSDEEP

1536:mbYhSxWHCT6NGmYFkL+q/A0opwCtH0YW5+1+fON:64cVkxA0QUrw

Score

10^/10

fickerstealer defense_evasion discovery infostealer

Malware Config

Extracted

Family

fickerstealer

45.93.201.181:80

Signatures

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Executes dropped EXE 2 IoCs

pid	Process
4856	Setup.exe
4000	Setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
15	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	api.ipify.org

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Setup.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "784369309"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31125420"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 71598.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Setup.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
1812	msedge.exe
1812	msedge.exe
4072	msedge.exe
4072	msedge.exe
3364	identity_helper.exe
3364	identity_helper.exe
704	msedge.exe
704	msedge.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe
4856	Setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2032	1812	msedge.exe	81
PID 1812 wrote to memory of 2032	1812	msedge.exe	81
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2236	1812	msedge.exe	82
PID 1812 wrote to memory of 2128	1812	msedge.exe	83
PID 1812 wrote to memory of 2128	1812	msedge.exe	83
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84
PID 1812 wrote to memory of 5080	1812	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\view.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbb5b43cb8,0x7ffbb5b43cc8,0x7ffbb5b43cd8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2636 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,3363882340990344519,14157890533671739060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3380 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:704
- C:\Users\Admin\Downloads\Setup.exe
  "C:\Users\Admin\Downloads\Setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4856
- - C:\Users\Admin\Downloads\Setup.exe
    "C:\Users\Admin\Downloads\Setup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1436

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\ReadOpen.gif
1⤵
- Modifies Internet Explorer settings
PID:4012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\krosqm.txt

Filesize
13B

MD5
907326301a53876360553d631f2775c4

SHA1
e900c12c18a7295611f3e2234bc68e8dc0501e06

SHA256
d5543b3a5715587c9c0993a7f56f3e1ee445af837f62c38f2f3457a2ea8d00c8

SHA512
435c1fd96b79b70c370d6f769d44eca3e682404189ff42a6b5718c21bf9dc8358d72c115d68dc25014b8cb9c709af0e64de012103fce687cf4a340fa8f3ea2aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2ee16858e751901224340cabb25e5704

SHA1
24e0d2d301f282fb8e492e9df0b36603b28477b2

SHA256
e9784fcff01f83f4925f23e3a24bce63314ea503c2091f7309c014895fead33c

SHA512
bd9994c2fb4bf097ce7ffea412a2bed97e3af386108ab6aab0df9472a92d4bd94489bb9c36750a92f9818fa3ea6d1756497f5364611e6ebd36de4cd14e9a0fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea667b2dedf919487c556b97119cf88a

SHA1
0ee7b1da90be47cc31406f4dba755fd083a29762

SHA256
9e7e47ebf490ba409eab3be0314fa695bf28f4764f4875c7568a54337f2df70f

SHA512
832391afcac34fc6c949dee8120f2a5f83ca68c159ff707751d844b085c7496930f0c8fd8313fd8f10a5f5725138be651953934aa79b087ba3c6dd22eaa49c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
9c73572fea40b717cbca6b0e1a5ba603

SHA1
f24f405bb3200bdeabd97ea01cd2609f1f702428

SHA256
555d1bf694bf3667d27e738c6a21074b48e2a995d857dbef27c99a294aac9078

SHA512
23fef2a534fa5c0868ec15f984d501ce12c42f16f246390d1610d18ca86157782e0fe97dd12bd13b19ddad3adc657c96747eb8fcfa388079f9fba1e20d0f4438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7952fbe122c32a212d7ec5bfca4cf498

SHA1
33a0195ec5a534f05eff84ded03f5c858c42cb09

SHA256
c95b6ed4f76f7a354cb547b62eb1f78b67f2d9114ff8f21f492c241f3a3086c3

SHA512
1fc04514b9ec42df8799bce4f3c193cd338f55afd219d3fa85fcc1e35d5235026689fb76123a79ce7da4e55a6aa39ba1598a67ac2cb0a4dad6dc239dcf52f9d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2f8693527a2b6d5d631aafcf89419c5e

SHA1
01179be844a8e4dea8e22adfc7fdd5eb3e2d16df

SHA256
8e8679e7264427333ddc5f7d4ce1d32e1ec4e1961f0063344d2c1fb768591456

SHA512
9a5cd931ef9c547a1c18fcd3745cb6ee5bfe03c9df8460ac4e1fb2d0d27ae028ae75d18dd6165358abaecb08416c70176ef20f8aa17602e535b390af29dc8443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ae534f99cf5e23675a836e0501c6d63b

SHA1
b47c48161fa8d93aaa940e7e8e12c0744a3bf0c2

SHA256
26246ae3eb3a02b5cd67989e739c3184406c272e0b84792da392700a135eb8e5

SHA512
2ce6b9f8fd5aa9361a96ac76dc3bc51daade724e2b4c1c0db0d423000a05660c327a4ec051401352d5d56e445407972be8a5cb8dc46ee8e97a1b153847fca4f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
58402687f2af1f4eb3624f968f5a9e0a

SHA1
5b41ef1831538267479abc3afcffe2f8b36f4224

SHA256
4f8c90be2e00edf494fec01daa144eeec7c4ec5f36062cd86181a85764237b4d

SHA512
112c20a0987208d31e82395a81d8b13db7a0b27e55157352af869889e300286356a3f34af83a157594d9266db400367afe3d4f8bdddd6c1a4e8cf55c6c7cf380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dff03f10b0ddf32faa92569d94071d58

SHA1
7f0840994d916c5efa22b8155b25877dad0e7642

SHA256
32ad4032e5ad588d5bb6a232b45d1445c9ba73401f825badb18bb763d19a3b36

SHA512
58a103ae1e49fe4995941d6a27fe657f91a9d19025e659607749f63e6ac58b226f57db4fe5a828f1187d442d624ab2b35e03e4c8d27a8625eb4b4b1c1c137f2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
1ec6f958f4b9fa8a9ce02c6e350bcf00

SHA1
ac5a263538738c8cbc04a2478e08a8724b570a14

SHA256
62892d8f64fc533ec27fe9016f0499e85fd838fefc86c0c1e15a81546e93eb23

SHA512
7772d186c8755b182b7a27ebffaaa8f518f1a14094d1f6c9ce17182ec471de3de265f16d43d742e5b9f92b57bf358df0f5ef1a63232fa4f52efc8555d4ed63b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57edea.TMP

Filesize
539B

MD5
4d1eca56efb1daf24272a30d810370da

SHA1
bcdc5b3505c483add71cfa7a604ac9e286fce3d9

SHA256
ddc5e7d2e686f51464ab76f77a4428e271152ef32e3f8fb1e7288c3e0b580c50

SHA512
ab839523c831cca7c8968fb19eb574ed19a640c7601394add7ab3310f3a6bfabbddbd01db1a4798effe3b7c50921112ac4a7112093d2c3b096b757e0e7792477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
66811f90d5b535fa6a172658a71e5b7b

SHA1
7b32a57d558bb0c57e5108db0a57531a80d83cf4

SHA256
fff2644634ef0966aa1ab8f04f2eef36b590275d5677e6113cc4f588a0034483

SHA512
3ead0d3435386695de7ac294effed66d8750991bae914f0708c476919f4a3876aecf9af0427094c15a8b84d093ee61fae211833dad6091da7b56a4f6524955ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6ea3d79ec7e72a55aa1514d897ad1ad0

SHA1
25cd5828afa491d299096ce7dd1692300db90a71

SHA256
27d1a6ab88351cba02505a8c71aae0528dcd28b67898497f470e6ed85509bd29

SHA512
844960c85360dc6117eb973993cdcc0cec638355f1465cfb24905bf75f3200042d408173f9ee0aa6e9bc351f1b7192b6dbab269025ad1403c08e2de82e93b98d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
34fd387265e31b8db93ff1371286395d

SHA1
995b5f4da515893467edd7c51a9a8918c44d400c

SHA256
3e00270bf80118f7508c0ed974d6e3cb408562835e6523acd95e23e3c7449631

SHA512
18548e5a47451cf3add3b6f776220ee884ebb4e2397303d0ad5a89e97b0e77a2ecc29376b101f526b37991a06855f013eb84763f7bee1ca4607145eb2037b7bd

Download Submit
C:\Users\Admin\Downloads\Setup.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/4000-202-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4000-205-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4000-204-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4000-212-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4856-201-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download