rhadamanthys | hxxps://t[.]ly/AlJallafAdvocatesLegalConsultants

Analysis

max time kernel
191s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.ly/AlJallafAdvocatesLegalConsultants

Score

10^/10

rhadamanthys discovery persistence stealer

Malware Config

Extracted

Family

rhadamanthys

https://74.81.56.118:8039/526046b7d0d9c94cea1fa53/nqu6u8dd.p5rds

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

Asset recovery procedures in intellectual property disputes - Al Jallaf Advocates & Legal Consultants.exe

description	pid	Process	procid_target
PID 2988 created 2536	2988	Asset recovery procedures in intellectual property disputes - Al Jallaf Advocates & Legal Consultants.exe	42

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*UpdaterCisco = "rundll32.exe C:\\Users\\Admin\\Documents\\CiscoUpdater000_PARTIAL.dll,EntryPoint"	reg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
4328	2988	WerFault.exe	120
4008	2988	WerFault.exe	120

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Asset recovery procedures in intellectual property disputes - Al Jallaf Advocates & Legal Consultants.exeAsset recovery procedures in intellectual property disputes - Al Jallaf Advocates & Legal Consultants.execmd.exereg.exeopenwith.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Asset recovery procedures in intellectual property disputes - Al Jallaf Advocates & Legal Consultants.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Asset recovery procedures in intellectual property disputes - Al Jallaf Advocates & Legal Consultants.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exeAsset recovery procedures in intellectual property disputes - Al Jallaf Advocates & Legal Consultants.exeopenwith.exemsedge.exe

pid	Process
3500	msedge.exe
3500	msedge.exe
2816	msedge.exe
2816	msedge.exe
2660	identity_helper.exe
2660	identity_helper.exe
4776	msedge.exe
4776	msedge.exe
2988	Asset recovery procedures in intellectual property disputes - Al Jallaf Advocates & Legal Consultants.exe
2988	Asset recovery procedures in intellectual property disputes - Al Jallaf Advocates & Legal Consultants.exe
3388	openwith.exe
3388	openwith.exe
3388	openwith.exe
3388	openwith.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 2816 wrote to memory of 2436	2816	msedge.exe	83
PID 2816 wrote to memory of 2436	2816	msedge.exe	83
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3424	2816	msedge.exe	84
PID 2816 wrote to memory of 3500	2816	msedge.exe	85
PID 2816 wrote to memory of 3500	2816	msedge.exe	85
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86
PID 2816 wrote to memory of 1164	2816	msedge.exe	86

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2536
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.ly/AlJallafAdvocatesLegalConsultants
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb026546f8,0x7ffb02654708,0x7ffb02654718
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10869926343833419168,13092671371914031968,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,10869926343833419168,13092671371914031968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,10869926343833419168,13092671371914031968,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10869926343833419168,13092671371914031968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10869926343833419168,13092671371914031968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10869926343833419168,13092671371914031968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10869926343833419168,13092671371914031968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10869926343833419168,13092671371914031968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10869926343833419168,13092671371914031968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10869926343833419168,13092671371914031968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10869926343833419168,13092671371914031968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,10869926343833419168,13092671371914031968,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10869926343833419168,13092671371914031968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,10869926343833419168,13092671371914031968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10869926343833419168,13092671371914031968,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4556 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2504

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2460

C:\Users\Admin\Downloads\Asset recovery procedures in intellectual property disputes - Al Jallaf Advocates & Legal Consultants\Asset recovery procedures in intellectual property disputes - Al Jallaf Advocates & Legal Consultants.exe
"C:\Users\Admin\Downloads\Asset recovery procedures in intellectual property disputes - Al Jallaf Advocates & Legal Consultants\Asset recovery procedures in intellectual property disputes - Al Jallaf Advocates & Legal Consultants.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5012
- C:\Users\Admin\Downloads\Asset recovery procedures in intellectual property disputes - Al Jallaf Advocates & Legal Consultants\Asset recovery procedures in intellectual property disputes - Al Jallaf Advocates & Legal Consultants.exe
  "C:\Users\Admin\Downloads\Asset recovery procedures in intellectual property disputes - Al Jallaf Advocates & Legal Consultants\Asset recovery procedures in intellectual property disputes - Al Jallaf Advocates & Legal Consultants.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 464
    3⤵
    - Program crash
    PID:4328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 460
    3⤵
    - Program crash
    PID:4008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f & exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4728
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2988 -ip 2988
1⤵
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2988 -ip 2988
1⤵
PID:220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\65be6956-268f-4c79-b889-f18e0917c872.tmp

Filesize
10KB

MD5
6e1f0868a1df01f7ab6c93b151c3720b

SHA1
1459d2feeb94d0421ef394c2d75e14c9fd7564bb

SHA256
fd8e7d9c7f363d2a1fe284a6f366302c99542cc57fc9eb041f416e17333ed8e3

SHA512
66cdc824d3ef9a74d21e7e8b039d693b7e5a2bc295ee42d7b47e1251538bde10b750995b1f1e294327e9426229697548f1d9223a913f739a42851da118cc70d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
357B

MD5
92b30d5f5b978a0544be0bff497c96dd

SHA1
282675ff93ec5f7e9638a08bb6dc799410b4f5b6

SHA256
eda246fb52c9dd047eefd965c5c98332b704429aa9f699d24513d47ec6e7a076

SHA512
78800ec08d693dd5851699a71df50e674e635a891f0427a3237461f7883b00bbd677bdb07fcb92cbb36eb22a7d11ed0dbbff855651126f8aa992524e509e1a7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a15fc43fba079e74586bf7ed50478c49

SHA1
78a3e142fd3698d7d9784ebbe7a94f3aee20200c

SHA256
a0f9aa751438faa3951846c18b959ae47f629bf8d2570a88e02df9f151bf35e1

SHA512
3521328362095b3b8be58cf2a54d47bc0d1806e753f40d9e45331d45dc42e7dca4d1a039f248fda20d45098353b2856626b2941ffadb624a4eb0fcaf95f30b47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c26b28b120ab6a993da19c78c53d5ab0

SHA1
0bd69c1cb1cc816f6aea5825180f1903643c9af2

SHA256
89cb2f1f5275e7c15a71893978aa67c5e2e59bde51d50251c77f451b140e7047

SHA512
d2c1f7b743028bc157de7b4e9dd4f5004aa2e5c5acacdc31dc594ab283f73f3c25f6e5ee8472a5bd28015799325211348fd7afeb6e9821370bad2cbbaad6f94f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
df1008ac5c1a7e511fb9bd90da6c5c5e

SHA1
4944949306b507f906ba882c6fd8627ee0a8a2cf

SHA256
4c5856afebe68f0c5dc59aaba157fa26ab81686bcbaeaf728fe3370c60762f45

SHA512
583778c6db29688b5594063a25851428c7b84cbdb8e9143309f0f04bd994a4e1d92031dd4624148b80a9fab6c2ec8448905421c4a5ca5353c6e6ee53e834e69c

Download Submit
\??\pipe\LOCAL\crashpad_2816_BJWGGSTLBLRVMPGR

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2988-135-0x00000000038F0000-0x0000000003CF0000-memory.dmp

Filesize
4.0MB

Download
memory/2988-138-0x00007FFB118B0000-0x00007FFB11AA5000-memory.dmp

Filesize
2.0MB

Download
memory/2988-147-0x0000000000400000-0x0000000000A2B000-memory.dmp

Filesize
6.2MB

Download
memory/2988-134-0x0000000000A30000-0x0000000000AAE000-memory.dmp

Filesize
504KB

Download
memory/2988-130-0x0000000000A30000-0x0000000000AAE000-memory.dmp

Filesize
504KB

Download
memory/2988-140-0x0000000075580000-0x0000000075795000-memory.dmp

Filesize
2.1MB

Download
memory/2988-137-0x00000000038F0000-0x0000000003CF0000-memory.dmp

Filesize
4.0MB

Download
memory/3388-144-0x00007FFB118B0000-0x00007FFB11AA5000-memory.dmp

Filesize
2.0MB

Download
memory/3388-146-0x0000000075580000-0x0000000075795000-memory.dmp

Filesize
2.1MB

Download
memory/3388-143-0x0000000002860000-0x0000000002C60000-memory.dmp

Filesize
4.0MB

Download
memory/3388-141-0x0000000000B50000-0x0000000000B59000-memory.dmp

Filesize
36KB

Download
memory/5012-132-0x0000000064000000-0x00000000641D5000-memory.dmp

Filesize
1.8MB

Download
memory/5012-125-0x0000000000400000-0x0000000000A2B000-memory.dmp

Filesize
6.2MB

Download
memory/5012-131-0x0000000064000000-0x00000000641D5000-memory.dmp

Filesize
1.8MB

Download
memory/5012-126-0x0000000064000000-0x00000000641D5000-memory.dmp

Filesize
1.8MB

Download
memory/5012-127-0x0000000064000000-0x00000000641D5000-memory.dmp

Filesize
1.8MB

Download
memory/5012-129-0x0000000064000000-0x00000000641D5000-memory.dmp

Filesize
1.8MB

Download
memory/5012-128-0x0000000064000000-0x00000000641D5000-memory.dmp

Filesize
1.8MB

Download