metasploit | 65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16-09-2024 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
Size

1.8MB
MD5

660d86b160eb7bf421b5782906adcccb
SHA1

8d54bb1a5bda036a4fc4af5cdf07219728c62e95
SHA256

65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb
SHA512

f098f81847aa528e6839c17c9f6e01e657c7b321b7da19ef453286bc2eee6ed5490dad58eedb3704d548977dc47600ceeb8e8ee64694f2dded40523d1d457eb4
SSDEEP

24576:/3vLRdVhZBK8NogWYO09LOGi9JoBqgvppOir7kw8atSw6ZwaIi0HjwC/hR:/3d5ZQ1NxJ/QUiUUt96Z0D

Score

10^/10

metasploit backdoor discovery spyware stealer trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

1.15.12.73:4567

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\R:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\S:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\B:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\G:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\I:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\J:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\K:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\U:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\Z:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\N:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\T:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\Y:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\E:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\H:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\M:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\Q:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\W:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\A:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\L:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\P:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\V:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
File opened (read-only)	\??\X:	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
2128	msedge.exe
2128	msedge.exe
724	identity_helper.exe
724	identity_helper.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
Token: SeDebugPrivilege	3036	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
Token: SeDebugPrivilege	2156	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
Token: SeDebugPrivilege	2156	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2156	3036	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe	82
PID 3036 wrote to memory of 2156	3036	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe	82
PID 3036 wrote to memory of 2156	3036	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe	82
PID 2156 wrote to memory of 2128	2156	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe	87
PID 2156 wrote to memory of 2128	2156	65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe	87
PID 2128 wrote to memory of 1200	2128	msedge.exe	88
PID 2128 wrote to memory of 1200	2128	msedge.exe	88
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 4576	2128	msedge.exe	89
PID 2128 wrote to memory of 1416	2128	msedge.exe	90
PID 2128 wrote to memory of 1416	2128	msedge.exe	90
PID 2128 wrote to memory of 4484	2128	msedge.exe	91
PID 2128 wrote to memory of 4484	2128	msedge.exe	91
PID 2128 wrote to memory of 4484	2128	msedge.exe	91
PID 2128 wrote to memory of 4484	2128	msedge.exe	91
PID 2128 wrote to memory of 4484	2128	msedge.exe	91
PID 2128 wrote to memory of 4484	2128	msedge.exe	91
PID 2128 wrote to memory of 4484	2128	msedge.exe	91
PID 2128 wrote to memory of 4484	2128	msedge.exe	91
PID 2128 wrote to memory of 4484	2128	msedge.exe	91
PID 2128 wrote to memory of 4484	2128	msedge.exe	91
PID 2128 wrote to memory of 4484	2128	msedge.exe	91
PID 2128 wrote to memory of 4484	2128	msedge.exe	91
PID 2128 wrote to memory of 4484	2128	msedge.exe	91
PID 2128 wrote to memory of 4484	2128	msedge.exe	91
PID 2128 wrote to memory of 4484	2128	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
"C:\Users\Admin\AppData\Local\Temp\65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe
  "C:\Users\Admin\AppData\Local\Temp\65158a271917b2dbed5ce52df7073288d9ae3305cc0922ff431cee4ffdf6dcfb.exe" Admin
  2⤵
  - Drops file in Drivers directory
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa42b46f8,0x7ffaa42b4708,0x7ffaa42b4718
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13797851147027297896,350733629560665634,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,13797851147027297896,350733629560665634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,13797851147027297896,350733629560665634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13797851147027297896,350733629560665634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
      4⤵
      PID:1156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13797851147027297896,350733629560665634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13797851147027297896,350733629560665634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
      4⤵
      PID:4356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13797851147027297896,350733629560665634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13797851147027297896,350733629560665634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13797851147027297896,350733629560665634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13797851147027297896,350733629560665634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13797851147027297896,350733629560665634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13797851147027297896,350733629560665634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
      4⤵
      PID:384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13797851147027297896,350733629560665634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:1
      4⤵
      PID:3248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13797851147027297896,350733629560665634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13797851147027297896,350733629560665634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:1
      4⤵
      PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13797851147027297896,350733629560665634,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c55e6638160f1f0c7b9431cdf8b70704

SHA1
8a63a135a84bb42190d6e875c857e34f7be87bbc

SHA256
1609c88bdf904358fd107841c14d51ff9cb378b21061c24def24af749b8e25d2

SHA512
c08143168561b4a1f21d5c533d5d39dd93a249429084057c771bf7333219ef150cc08ba10db33ac16c5712f2293545fb470471afb67e49e6b2a7f7972afeb25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d06985cdadcdd2fc58afd80a5a9b597

SHA1
da6594d4345107ca0ce5ac2bfc0e145e70653666

SHA256
b79d346a41ea75c41971ef9f32a25c162c57f7ffdca104c7ea5900c1bf4f9c34

SHA512
9efb4a021a553c6a854a233121fc8a23816d05e0676ae55a630891ccddcb4e9bc4f2abc9049998ef0a14443329985ec3e43d522c2895a996790b680d84f9d41c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7baf810263d062a6eee895517823749d

SHA1
319321b593d5e2defc9c13d4f5c44aa760db6155

SHA256
44f89acf1ca4acc48d772c1f4ba64b233f8cf0185c5fd7111a13142de5c155f6

SHA512
186d7f9695bc3d37d267ffd9a26d6fc428e599f5be5575e3d59280850fb099cee71e92b5d34dc1879ada57ef883c7733a8d57b149e89feece344367d91e7d203

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
822B

MD5
03450e8ddb20859f242195450c19b8f1

SHA1
9698f8caf67c8853e14c8bf4933949f458c3044a

SHA256
1bdd8f1dd7bd82b5b2313d8770dfe4f41cd3f45bbaeab8b8a7f75fc5e2d3720b

SHA512
87371e57bf2296af5ec7f5db772a4ce66729d54aa23a8b384e3f4c42310b97b636576c7dff67c27a3b679339cdeee05b836563ae2a878f0367caf247b3e1ba7b

Download Submit
memory/2156-6-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/2156-12-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/2156-10-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/2156-9-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/3036-4-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/3036-3-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/3036-0-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/3036-2-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download