rhadamanthys | hxxps://t[.]ly/GoldenScene10

Analysis

max time kernel
129s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.ly/GoldenScene10

Score

10^/10

rhadamanthys discovery persistence stealer

Malware Config

Extracted

Family

rhadamanthys

https://74.81.56.118:8039/526046b7d0d9c94cea1fa53/nqu6u8dd.p5rds

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

圖片和視頻侵犯版權 - Golden Scene.exe

description pid process target process

PID 5836 created 2632 5836 圖片和視頻侵犯版權 - Golden Scene.exe sihost.exe

description	pid	process	target process
PID 5836 created 2632	5836	圖片和視頻侵犯版權 - Golden Scene.exe	sihost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*UpdaterCisco = "rundll32.exe C:\\Users\\Admin\\Documents\\CiscoUpdater000_PARTIAL.dll,EntryPoint"	reg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
6064	5836	WerFault.exe	圖片和視頻侵犯版權 - Golden Scene.exe
6096	5836	WerFault.exe	圖片和視頻侵犯版權 - Golden Scene.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

圖片和視頻侵犯版權 - Golden Scene.exe圖片和視頻侵犯版權 - Golden Scene.execmd.exereg.exeopenwith.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	圖片和視頻侵犯版權 - Golden Scene.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	圖片和視頻侵犯版權 - Golden Scene.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe圖片和視頻侵犯版權 - Golden Scene.exeopenwith.exemsedge.exe

pid	process
3352	msedge.exe
3352	msedge.exe
3100	msedge.exe
3100	msedge.exe
3200	identity_helper.exe
3200	identity_helper.exe
5260	msedge.exe
5260	msedge.exe
5836	圖片和視頻侵犯版權 - Golden Scene.exe
5836	圖片和視頻侵犯版權 - Golden Scene.exe
5956	openwith.exe
5956	openwith.exe
5956	openwith.exe
5956	openwith.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3100 msedge.exe
3100 msedge.exe
3100 msedge.exe
3100 msedge.exe
3100 msedge.exe
3100 msedge.exe
3100 msedge.exe

Suspicious use of FindShellTrayWindow 48 IoCs

Processes:

msedge.exe

pid	process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3100 wrote to memory of 4804	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4804	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 408	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 3352	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 3352	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe
PID 3100 wrote to memory of 4180	3100	msedge.exe	msedge.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2632
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.ly/GoldenScene10
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e8a146f8,0x7ff8e8a14708,0x7ff8e8a14718
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4159186835991873746,7418198968681216982,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,4159186835991873746,7418198968681216982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,4159186835991873746,7418198968681216982,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4159186835991873746,7418198968681216982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4159186835991873746,7418198968681216982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4159186835991873746,7418198968681216982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4159186835991873746,7418198968681216982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,4159186835991873746,7418198968681216982,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4159186835991873746,7418198968681216982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4159186835991873746,7418198968681216982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4159186835991873746,7418198968681216982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4159186835991873746,7418198968681216982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4159186835991873746,7418198968681216982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,4159186835991873746,7418198968681216982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4159186835991873746,7418198968681216982,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5428

C:\Users\Admin\Downloads\圖片和視頻侵犯版權 - Golden Scene\圖片和視頻侵犯版權 - Golden Scene.exe
"C:\Users\Admin\Downloads\圖片和視頻侵犯版權 - Golden Scene\圖片和視頻侵犯版權 - Golden Scene.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5676
- C:\Users\Admin\Downloads\圖片和視頻侵犯版權 - Golden Scene\圖片和視頻侵犯版權 - Golden Scene.exe
  "C:\Users\Admin\Downloads\圖片和視頻侵犯版權 - Golden Scene\圖片和視頻侵犯版權 - Golden Scene.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5836 -s 464
    3⤵
    - Program crash
    PID:6064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5836 -s 488
    3⤵
    - Program crash
    PID:6096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f & exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5880
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5836 -ip 5836
1⤵
PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5836 -ip 5836
1⤵
PID:6080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
357B

MD5
ec6d12de1569f3a257ec1ebd80beecd9

SHA1
38f3cdb6be8f47eede305e41478ba17385cb34ca

SHA256
ba73cfdaae16a15125e982936eec4e1ac512f23b37489abf2e78252d6bd7a9d4

SHA512
e0257b0faf7053472c7d992254af92f13d5b6338c86d3d7675265d9a33d0cc4049ecdf8f54e1709f2d36c24a8b1655e110bb1f15592e651e153a93ee46fc1654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5b3ed396505349374b6c2673be969fa5

SHA1
b174014d4d11fae8f4f7e1cc09bee60ff9f36603

SHA256
8147d9f79c4dc01fee387aa72c03c4d9ba603af74a48883125e4935a2dfd6c76

SHA512
61178755dd8a03c8939d9c4c7fb9e669f11597b4ade250cdef469d14628647ace620763a7c81584e4017c6a75049721606879e5a51bfc3cf2d88d8c1a1d32a3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce37a75184b377c3ef213a9e51e63291

SHA1
f9c5c06e70612062af8eef5e923152433ed78aab

SHA256
29462eefe587b40df03c542247e1c65c13d31d9f177600be40094a81ae17b330

SHA512
4ebdf247b3e97b88c59143e43bee53c4488a41ef8d3087448737885bbc4a9d3b85b8a42082b9106a63e05317824e5610005cdb1eabb1913f9a3a8824b27bd0a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0e2c548dc7d094e8a1e6e829c5767c92

SHA1
94302f0c500451ae05640098d413ac5014547ed3

SHA256
c0642693ca9c683b5d862c4f9c5a5c4fd00cb2fdce6e420ee066ad2af545e805

SHA512
3786c4b4197c42e5568ef7e6b16e26a5558006508a13b33ca6d47a8ead5f224d8be317a4527b6c0d3064a494a996fb306221172d0e75a37d9eeff887ba4823ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
83a2159688b5a888f776d6c2b9e9d121

SHA1
cc464dee1defc282b9924374fac07a6ae937ae29

SHA256
c58517fe50fa9d139214c35dcaeaf703f64ea1796eb5a9c5c147ccaffd5105b9

SHA512
68205c9a34c0a902eea7415d8f09b73a492d53965799a1d53f52126608750fffa8609aac03cc547ceb0ef4b696e5f0920f2e4041979504918c28e7b1c141513a

Download Submit
\??\pipe\LOCAL\crashpad_3100_YLFVWQHUSWGZJOEB

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/5676-88-0x0000000064000000-0x00000000641D5000-memory.dmp

Filesize
1.8MB

Download
memory/5676-85-0x0000000064000000-0x00000000641D5000-memory.dmp

Filesize
1.8MB

Download
memory/5676-86-0x0000000064000000-0x00000000641D5000-memory.dmp

Filesize
1.8MB

Download
memory/5676-83-0x0000000064000000-0x00000000641D5000-memory.dmp

Filesize
1.8MB

Download
memory/5676-84-0x0000000064000000-0x00000000641D5000-memory.dmp

Filesize
1.8MB

Download
memory/5676-89-0x0000000064000000-0x00000000641D5000-memory.dmp

Filesize
1.8MB

Download
memory/5836-87-0x0000000000A30000-0x0000000000AAE000-memory.dmp

Filesize
504KB

Download
memory/5836-92-0x0000000003790000-0x0000000003B90000-memory.dmp

Filesize
4.0MB

Download
memory/5836-93-0x0000000003790000-0x0000000003B90000-memory.dmp

Filesize
4.0MB

Download
memory/5836-94-0x00007FF8F79B0000-0x00007FF8F7BA5000-memory.dmp

Filesize
2.0MB

Download
memory/5836-96-0x0000000076B70000-0x0000000076D85000-memory.dmp

Filesize
2.1MB

Download
memory/5836-91-0x0000000000A30000-0x0000000000AAE000-memory.dmp

Filesize
504KB

Download
memory/5956-97-0x0000000000190000-0x0000000000199000-memory.dmp

Filesize
36KB

Download
memory/5956-99-0x00000000020D0000-0x00000000024D0000-memory.dmp

Filesize
4.0MB

Download
memory/5956-100-0x00007FF8F79B0000-0x00007FF8F7BA5000-memory.dmp

Filesize
2.0MB

Download
memory/5956-102-0x0000000076B70000-0x0000000076D85000-memory.dmp

Filesize
2.1MB

Download