nanocore | 4f4732e54644b08be1c2ac9851fb21c947570d674083e9f614f3cbeef3ccf1e6

Resubmissions

19-08-2024 20:50

240819-zmvjesyhjk 10

19-08-2024 20:45

240819-zj32dsyfql 10

Analysis

max time kernel
1795s
max time network
1795s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ss.exe
Size

202KB
MD5

e61bc4ecaac4354b240d56fa48c67790
SHA1

c8c83c518188d7adf2a2a485b20e033a6f8a0602
SHA256

4f4732e54644b08be1c2ac9851fb21c947570d674083e9f614f3cbeef3ccf1e6
SHA512

4bec8a6067b1aa9f2b25559c5bac61aa45b90619fb713432824e9e8bd2c06e4193acab18031c7df9eb643bc17b3aa0807b49ce790b13870248f8907ad89c6ccc
SSDEEP

6144:gLV6Bta6dtJmakIM5Pt2cK5cxxQRlsm67rBDDz:gLV6Btpmkq2cK5cxxqUn5z

Score

10^/10

nanocore discovery evasion keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ss.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ss.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133685742917505835"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1696	ss.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
4052	taskmgr.exe
4052	taskmgr.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
1696	ss.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
1696	ss.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1696	ss.exe
4052	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
736	chrome.exe
736	chrome.exe
736	chrome.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1696	ss.exe
Token: SeDebugPrivilege	4052	taskmgr.exe
Token: SeSystemProfilePrivilege	4052	taskmgr.exe
Token: SeCreateGlobalPrivilege	4052	taskmgr.exe
Token: 33	4052	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4052	taskmgr.exe
Token: SeShutdownPrivilege	736	chrome.exe
Token: SeCreatePagefilePrivilege	736	chrome.exe
Token: SeShutdownPrivilege	736	chrome.exe
Token: SeCreatePagefilePrivilege	736	chrome.exe
Token: SeShutdownPrivilege	736	chrome.exe
Token: SeCreatePagefilePrivilege	736	chrome.exe
Token: SeShutdownPrivilege	736	chrome.exe
Token: SeCreatePagefilePrivilege	736	chrome.exe
Token: SeShutdownPrivilege	736	chrome.exe
Token: SeCreatePagefilePrivilege	736	chrome.exe
Token: SeShutdownPrivilege	736	chrome.exe
Token: SeCreatePagefilePrivilege	736	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
4052	taskmgr.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 2196	736	chrome.exe	108
PID 736 wrote to memory of 2196	736	chrome.exe	108
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 2644	736	chrome.exe	109
PID 736 wrote to memory of 4716	736	chrome.exe	110
PID 736 wrote to memory of 4716	736	chrome.exe	110
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111
PID 736 wrote to memory of 1288	736	chrome.exe	111

C:\Users\Admin\AppData\Local\Temp\ss.exe
"C:\Users\Admin\AppData\Local\Temp\ss.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff2b00cc40,0x7fff2b00cc4c,0x7fff2b00cc58
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1864,i,3417142420812216886,2874739784933624135,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2128,i,3417142420812216886,2874739784933624135,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,3417142420812216886,2874739784933624135,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2340 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3192,i,3417142420812216886,2874739784933624135,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3352,i,3417142420812216886,2874739784933624135,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3184,i,3417142420812216886,2874739784933624135,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4748,i,3417142420812216886,2874739784933624135,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4784,i,3417142420812216886,2874739784933624135,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:5152

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff293a46f8,0x7fff293a4708,0x7fff293a4718
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,10885469534457580248,4434418562985682062,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,10885469534457580248,4434418562985682062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,10885469534457580248,4434418562985682062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,10885469534457580248,4434418562985682062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,10885469534457580248,4434418562985682062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,10885469534457580248,4434418562985682062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,10885469534457580248,4434418562985682062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,10885469534457580248,4434418562985682062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,10885469534457580248,4434418562985682062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,10885469534457580248,4434418562985682062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,10885469534457580248,4434418562985682062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,10885469534457580248,4434418562985682062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,10885469534457580248,4434418562985682062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,10885469534457580248,4434418562985682062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,10885469534457580248,4434418562985682062,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  PID:5048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
b0a8a532e3ac02d26bca12f6985f6e94

SHA1
a9dc2ea61064dd702addbaa64626de13eb11136d

SHA256
eb2dc6883a820eaec2b8c6104de7b90cfbc50ae3e26b30a20722b69189edd1a1

SHA512
db9c83393212370c3829d36170f175a2e88a8682eee40c67899f12a90d5e20ddc5e83db59cb0a6644e9d0dc11c853ca4a665f52dc7206b7491cc59ee027825bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
ec749569ebe26f89fff1a6a26b360f6a

SHA1
372ef8f52f8735a3abbdf2ec0c69b748e5314abe

SHA256
720b559f12a5e69734373906779fc4e53d871493f1c04f6c4c2ebb79cf388a91

SHA512
f564b8ebc491f54c9a27b5b23e579e7d5318e22e475cb5b722044a3c2d8caafb904a27d5945639544196af0e518749e0456bdce7ff0a03167af3f62b9e628f2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
3d98c0e80af542919501795251a09027

SHA1
efb6a3357071736464dd0f18fcb6cdff50e0f4d7

SHA256
772851aef71993940668e20af1fbda458abe9b0dd0f960f40577b00d66633207

SHA512
a1e729bc1a329808fd9bb4a493780b43811cd7f50fb43e58ca45a2af3beae5c5bbe7ba36143f5b63213d9d4c35afbeb0690a0dfe72361111ff9e89bb4c43b965

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
349d585b2565084b7d5441a91b619bb3

SHA1
87d19d4f5547cf9c13e7d56bf755a6c803fac491

SHA256
c740acfec9576c6c37815035dd3320a0a1873df2f0ce7be5d0c6d306a53f8983

SHA512
471d794cba9972c600db8104585c990f8a834a5eec77da147e8b38a92976b3d5e2f64b34f1b4667443b5c71aa5a2dfcf12d3e93c7ab6ca06a652d1cdc2b7d763

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
13KB

MD5
1cb39f8e8f0750c5052585e65d8bfe6f

SHA1
74ca6c1d99ace8876807ba3dff341a4f0f9d0882

SHA256
24ee48d9aba89b37222c50606511c7beda9e3c65242bd38ed0e8438db59f77d0

SHA512
7adf5b0a7f124d8cfb5b0e5149dcc7d9a5668e457cabfaf21e8cd6d999e4548aca76498a7fa09aa7e15aeb33944e78327bc712fe7c5b6b4536fbddab7c3d0e86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
199KB

MD5
472c9c55b1406d78210fce66a18f9fae

SHA1
ffcedc33ca15371ba8d63b025114b12544ca2282

SHA256
06907a654c34911d5fdd3ef5c73a6cb99a957079e9d8fb320597b98df67d9d44

SHA512
9aed38bd6dbb0c6ec21084e560c9dfe5b3b35ecdef6153fca0d14b3a30af694b58d93fddfd15343170ad34a5a886de7a74f11b405b0d18239602e1a305b7aba5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5596eda24f8bf0335cb72c3330b6b8c4

SHA1
7c21d7a68b972ed29b3a25636edcbf5584189d3b

SHA256
1895bc2de99ac2b793f06c8b1344c1dbf3563b41452e04d776c653efe5e904b1

SHA512
3f2437b5d6fe1d3946ab44a67037b51f0ecf719e9a01f93c89d51897edc0dbc81b0fa462b4b68e4a3d759f50f2eeef688f744b9b1cd350bda3249827d0e1c63c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0352d900959376919e8c057584a98201

SHA1
8963bd0a2867dfaecebc49781edbeaaa0f18c0e9

SHA256
8449d9268b52e4bdc488e74e6323cffab87cdec26c54fe6fd404df45513e315b

SHA512
c199ff1316c1086e9b71d30dc8eb9bc30459473ed4429f47f095730a3faa60f6caea795b0d19c46816445536a7741782ceb82ab78f9bd81f97426e6f40843a01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d8ed0a380ee91f76118a294f19a69f53

SHA1
12f67fbb4edcf0e4cc7f727113a1479ea6f1d4a6

SHA256
5c3f484aab55e9ef3c445c67320ddc7fe1a035955e55a41e96fa1565522110a4

SHA512
9bb9fce785803173c8b724b167b3de2fc3b55a9207a078314b45cd98ca9a1151497dd2f1da6c943bbd794b4c09906729a164ba747993b047651793ea7021c11a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/1696-0-0x00000000754E2000-0x00000000754E3000-memory.dmp

Filesize
4KB

Download
memory/1696-8-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/1696-7-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/1696-6-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/1696-5-0x00000000754E2000-0x00000000754E3000-memory.dmp

Filesize
4KB

Download
memory/1696-4-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/1696-2-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/1696-1-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/4052-9-0x000001E31CCA0000-0x000001E31CCA1000-memory.dmp

Filesize
4KB

Download
memory/4052-16-0x000001E31CCA0000-0x000001E31CCA1000-memory.dmp

Filesize
4KB

Download
memory/4052-17-0x000001E31CCA0000-0x000001E31CCA1000-memory.dmp

Filesize
4KB

Download
memory/4052-18-0x000001E31CCA0000-0x000001E31CCA1000-memory.dmp

Filesize
4KB

Download
memory/4052-19-0x000001E31CCA0000-0x000001E31CCA1000-memory.dmp

Filesize
4KB

Download
memory/4052-20-0x000001E31CCA0000-0x000001E31CCA1000-memory.dmp

Filesize
4KB

Download
memory/4052-21-0x000001E31CCA0000-0x000001E31CCA1000-memory.dmp

Filesize
4KB

Download
memory/4052-15-0x000001E31CCA0000-0x000001E31CCA1000-memory.dmp

Filesize
4KB

Download
memory/4052-10-0x000001E31CCA0000-0x000001E31CCA1000-memory.dmp

Filesize
4KB

Download
memory/4052-11-0x000001E31CCA0000-0x000001E31CCA1000-memory.dmp

Filesize
4KB

Download