silverrat | 92c5a24d6412d5e91c001b33ab65cd1094e55264db42ac1a5680a0b2907a638c

Analysis

max time kernel
100s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
submitted
11/09/2024, 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wire-transaction073921.exe
Size

172KB
MD5

6e39b6a0d1989cc7d65a28172be66bee
SHA1

4ed2c84403ba5c886d7b01bb58418ef20b1ee61a
SHA256

92c5a24d6412d5e91c001b33ab65cd1094e55264db42ac1a5680a0b2907a638c
SHA512

1a9a14ebeb42a97aa9db3ae5563cb74e6b2462f8240c7472589f4bf43eb61d4f9b0991ab6f9f75dd962735cb73bcb08b69756ef2091379cea52d2da778c8b20b
SSDEEP

3072:2ONzoeHI628bTzSGChyYPj4WtWkVImQIX9ftiJsDnXP:PO6fC7hnBRVZd9

Score

10^/10

silverrat discovery trojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

91.92.250.241:7777

Mutex

SilverMutex_HgGvFgusRA

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
discord
https://discord.com/api/webhooks/1164506929989685328/EbxjHHiH2x5cay35kElLjoPVZwWe9MYG0mf_N1EsUmtMz2RURj7xmy8gtlCt_SBYihkD
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
UFlZbVRGbXFKUlpFVVJBWXlOREdzREFWY0tFUGJr
payload_url
https://g.top4top.io/p_2522c7w8u1.png
reconnect_delay
4
server_signature
zIeguD3oh/dRIEteWg5zaGfOqAuxa8H4qUBztbAb7aoPqtTWj/x6+GjDJB0UBugAguk6gA09j+1BfHcXYHG93tjBn1PJ1W/yx8pZO8FkHaV2k38ITS/Dq6fVz/Revv5tpbiCPht/0SkOvH8wa6O/s1E0V+mOeFntNKahjnMmaEiT90fJ3fM438d0qCLpjhwLOZsd+acB/OuVuAXDiu1qc69b+ZxCniIGO/YFhA2mF7dZeF/ZLqx/AvimxBUXivlP36rRDo2C6hxR2qJJtYnDOMNptaBc5JvSTFlOjZAQYRzszHWafva1F/rNDN3Q/rRF58YNoEr/ebs7ernDlMqXQ0KV1VZUBfOQOXizbZmLD3RiW5QXAYFDsXaryO1TO/4pRwwpRJSZmdIJfpINtEhgPwYmRCYB7j967UxqCIaKOBEBN02evIZ5Z2cYjLQlsmOdD0Zu2/ulZ1nKTMPYiuT9/GfUY9yCzgDNBL8kJDHi6myf+OnBDbvlWPXLIxo6aW1QjlpHc2SwFtYaDF6FYU/IJshjjeewTH7MRVUZWdEMia4Mg82oXT2S8dAw5WtpMoeDjoG56PG85O/3w9YlgfpSDrIVMA4/03fR5pvHi2ocvtV7cmfxv97gU3llkfjfHAiXCDYDi73P5fkf1I1q3/1Dh7rK1nA3QZfNi19rYed88Vk=

Signatures

SilverRat
SilverRat is trojan written in C#.
trojan silverrat
Silverrat family
silverrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Wire-transaction073921.exe

Executes dropped EXE 2 IoCs

pid	Process
2476	Payload.cmd.exe
3156	30.dll

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
28	discord.com
30	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
4048	msedge.exe
4048	msedge.exe
3156	30.dll
3156	30.dll
212	identity_helper.exe
212	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3156	30.dll

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2476	Payload.cmd.exe
3156	30.dll

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 2476	4256	Wire-transaction073921.exe	83
PID 4256 wrote to memory of 2476	4256	Wire-transaction073921.exe	83
PID 4256 wrote to memory of 2476	4256	Wire-transaction073921.exe	83
PID 4256 wrote to memory of 4048	4256	Wire-transaction073921.exe	84
PID 4256 wrote to memory of 4048	4256	Wire-transaction073921.exe	84
PID 4048 wrote to memory of 1256	4048	msedge.exe	85
PID 4048 wrote to memory of 1256	4048	msedge.exe	85
PID 2476 wrote to memory of 3156	2476	Payload.cmd.exe	86
PID 2476 wrote to memory of 3156	2476	Payload.cmd.exe	86
PID 3156 wrote to memory of 4556	3156	30.dll	87
PID 3156 wrote to memory of 4556	3156	30.dll	87
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 4048 wrote to memory of 2172	4048	msedge.exe	89
PID 3156 wrote to memory of 5060	3156	30.dll	91
PID 3156 wrote to memory of 5060	3156	30.dll	91
PID 4048 wrote to memory of 3660	4048	msedge.exe	90
PID 4048 wrote to memory of 3660	4048	msedge.exe	90
PID 4048 wrote to memory of 3940	4048	msedge.exe	92
PID 4048 wrote to memory of 3940	4048	msedge.exe	92
PID 4048 wrote to memory of 3940	4048	msedge.exe	92
PID 4048 wrote to memory of 3940	4048	msedge.exe	92
PID 4048 wrote to memory of 3940	4048	msedge.exe	92
PID 4048 wrote to memory of 3940	4048	msedge.exe	92
PID 4048 wrote to memory of 3940	4048	msedge.exe	92
PID 4048 wrote to memory of 3940	4048	msedge.exe	92
PID 4048 wrote to memory of 3940	4048	msedge.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Wire-transaction073921.exe
"C:\Users\Admin\AppData\Local\Temp\Wire-transaction073921.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Users\Admin\AppData\Local\Temp\Payload.cmd.exe
  "C:\Users\Admin\AppData\Local\Temp\Payload.cmd.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Users\Admin\AppData\Local\Temp\30.dll
    C:\Users\Admin\AppData\Local\Temp\30.dll
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN 30.dll
      4⤵
      PID:4556
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Create /SC ONCE /TN "30.dll" /TR "C:\Users\Admin\AppData\Local\Temp\30.dll \"\30.dll\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5060
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN 30.dll
      4⤵
      PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Py017394- 01.htm
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff895e346f8,0x7ff895e34708,0x7ff895e34718
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,10833332451947804160,14612996198697788818,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,10833332451947804160,14612996198697788818,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,10833332451947804160,14612996198697788818,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10833332451947804160,14612996198697788818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10833332451947804160,14612996198697788818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10833332451947804160,14612996198697788818,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10833332451947804160,14612996198697788818,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10833332451947804160,14612996198697788818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10833332451947804160,14612996198697788818,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10833332451947804160,14612996198697788818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10833332451947804160,14612996198697788818,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10833332451947804160,14612996198697788818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10833332451947804160,14612996198697788818,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
    3⤵
    PID:4516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
565B

MD5
1917df00d2a871cb083578c405089f52

SHA1
81579bba7385d30258662e50202b54f8cedf9364

SHA256
f25416f221dcc4714144ecf159698c835ec680023352973208adf45b89db6c01

SHA512
6a0a4be4a4f4643a75e6c83843b8e84fa7489fbb1be16fe031f1459446b600ae3f99e19d7295361123cd700904f8f7b496112bc4149aecbaeddcaa9f2e4298a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4de7c9a73f7824a3dfec59db14e11ab5

SHA1
a3b90abadb2a44052d612b09a03858519c14cc41

SHA256
4cb99a31c05e362f7329a5f613615c333249a6a3913a69609687606c022c366f

SHA512
67685bc61de1f1a42931995a113eb66d88532eccc9d0c937a532c0a3fa87271fed7b0ce414ea9decfc75b680b2df425eadfd7d1ee593176d6e90de40c833c252

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
95412ab67708e0e97fd8cf691d9aa985

SHA1
debe4bf2bec8e1575b26c46ecdc98c3fab882ae2

SHA256
cf0509d50f6f648cfe9e26aa0c0e0d21d0aedd163cb833aaf0621fdfdcfdc646

SHA512
b16013b8ef523a045bfa221f39ce4276888f13d358be8a2a6314b4114794a2ea8763a2baf62fded64674fedf6ef0c8417f126125a0d20cefe885ffc416b0601b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5556e09b2d35a101ace59d0aa60c8b86

SHA1
d4ac35a676e7742a0019a1ac2bd39b8273269230

SHA256
50e12b84496a8eef248f1a545aa232f2ac09df8787577a2ffa58f8edeca7582e

SHA512
707a07614a5efdcf909bdf2b9bb62677ba133da4fa10b85e43dd47008757fba45dfad56ef13b243bda8333f79065be987fb8fb2ba942cd3f85239e6ca4e9092c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
548cea444589ba6c82c86b6dcd87467e

SHA1
9538c97fb0f1bb52c5f20bc7109079297c91cafe

SHA256
8fdcd8067240cb4e6a8e98dc09f17784a486d1038bbeba322e0f773ffa746c88

SHA512
230d0893f6bb00cb4bef90601df267950ebffd63af1a4b8ac04355ab3eba558e2222f1e5c0cb38c0eb749cb64ef3e44909a3a3a44c1fbfd966f26f66ec7c5278

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dc8478cc06e978318d24a32f4d4d46c0

SHA1
9c7a52e42bec16567f06eac34654eadb90d808bc

SHA256
a1b3e0426eca040377cbda672adc74c82a61d4f538f95b3dd19ac3b32a4446e7

SHA512
0fe0aa5c6272c2624ad191b2a550a1fb228d4a6b22ff2f63e3ae26086bb260df3927f9dacf8eabc416b7fd9cae3a9813817a6aa215733f35157e7ea8d7309a1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\30.dll

Filesize
40KB

MD5
e4613f35f44dfebe9ef25b1c2690392b

SHA1
ba473ebc0d0d2e3181b2ae8f8b9ebf63f30d4b61

SHA256
bf60d0f761f4433ee3f79a35411d9f4d79a09d730cdb8e26a4257de8de2856bb

SHA512
0d89c2af1030dfc693da2bbab4dcfd6d4cee6c2a5528036a9d402812f3e2a4a7cd0b2512418b3a852cfbc5b388e43a9cf0c3f9cfe01e18b0128eb7da1463da96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Payload.cmd.exe

Filesize
92KB

MD5
7b9d932d7fa6f4895fce34a4ef3625e9

SHA1
a02a6e650d55afc1eb802955e176581a37967099

SHA256
6004ce80c1520b3e77c6482e0dae0ba5ffc8b99220600b7f2338c372b0602d5b

SHA512
92e6c8662a91839271c4237b0f79e2b3d45ffc4ca37c1340d0d16e14830da1e0c3d6cf9085baf5d27a995b816c925606a197b0d9b43eec3677522988df3633e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Py017394- 01.htm

Filesize
7KB

MD5
3a8db5cc9a23f574df1f4ba0e82c76d8

SHA1
21061eb5897739814be409b12d00498a4f2af67a

SHA256
b4ed02bf7745732560f3512b746dbec1f82a0550ba68961bffa64bd704fb004e

SHA512
a279eb7772fb1430a91bca8abd130be4b4e4a871b71898705ea3e59f30b32c31efc1020a24acb76ed71046eb53454e3ba62833ad8b5a8d9120ae868479427c25

Download Submit
memory/3156-79-0x00007FF8871F0000-0x00007FF887CB1000-memory.dmp

Filesize
10.8MB

Download
memory/3156-31-0x00000000006F0000-0x00000000006FE000-memory.dmp

Filesize
56KB

Download
memory/3156-33-0x00007FF8871F0000-0x00007FF887CB1000-memory.dmp

Filesize
10.8MB

Download
memory/3156-85-0x00007FF8871F0000-0x00007FF887CB1000-memory.dmp

Filesize
10.8MB

Download
memory/3156-32-0x00007FF8871F0000-0x00007FF887CB1000-memory.dmp

Filesize
10.8MB

Download
memory/4256-0-0x00007FF8871F3000-0x00007FF8871F5000-memory.dmp

Filesize
8KB

Download
memory/4256-26-0x00007FF8871F0000-0x00007FF887CB1000-memory.dmp

Filesize
10.8MB

Download
memory/4256-3-0x00007FF8871F0000-0x00007FF887CB1000-memory.dmp

Filesize
10.8MB

Download
memory/4256-1-0x0000000000790000-0x00000000007C0000-memory.dmp

Filesize
192KB

Download