nanocore | fc8a11235f8077f937006cad2d1ece3aef3adef21bfb6351d3a2d6676c85a355

Resubmissions

05-10-2024 22:42

241005-2mwgtsveqr 10

05-10-2024 22:29

241005-2eqxdazanf 10

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2024 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OctoSniff_3.1.1.0.exe
Size

216KB
MD5

919f4a22f473c25abdf76b0bd738dd55
SHA1

a31a55b897e85385842762d470dd7ed5db48942a
SHA256

fc8a11235f8077f937006cad2d1ece3aef3adef21bfb6351d3a2d6676c85a355
SHA512

1ea0ac11a98dbdf7be1add47269b88a9bd3ea96fe3827c9f9bfc94940bce5147de925647d8fc547651a2caa879643ed75384044c10ce02e1f9d984feb9d9ac06
SSDEEP

6144:sLV6Bta6dtJmakIM507t2cK5cxxQRlsm67rBDDd:sLV6BtpmkZ2cK5cxxqUn5d

Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

anime34.ddns.net:3009

127.0.0.1:3009

Mutex

4b8c853c-7978-4de1-b5e7-765fc8ccf3fb

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-04-10T07:11:52.154554536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
3009
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
4b8c853c-7978-4de1-b5e7-765fc8ccf3fb
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
anime34.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

OctoSniff_3.1.1.0.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WAN Subsystem = "C:\\Program Files (x86)\\WAN Subsystem\\wanss.exe"	OctoSniff_3.1.1.0.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

OctoSniff_3.1.1.0.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OctoSniff_3.1.1.0.exe

Drops file in Program Files directory 2 IoCs

Processes:

OctoSniff_3.1.1.0.exe

description	ioc	Process
File created	C:\Program Files (x86)\WAN Subsystem\wanss.exe	OctoSniff_3.1.1.0.exe
File opened for modification	C:\Program Files (x86)\WAN Subsystem\wanss.exe	OctoSniff_3.1.1.0.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

OctoSniff_3.1.1.0.exeOctoSniff_3.1.1.0.exeOctoSniff_3.1.1.0.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OctoSniff_3.1.1.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OctoSniff_3.1.1.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OctoSniff_3.1.1.0.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

OctoSniff_3.1.1.0.exetaskmgr.exemsedge.exemsedge.exeidentity_helper.exe

pid	Process
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
3464	taskmgr.exe
3464	taskmgr.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
928	msedge.exe
928	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
436	OctoSniff_3.1.1.0.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3328	identity_helper.exe
3328	identity_helper.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OctoSniff_3.1.1.0.exetaskmgr.exe

pid	Process
436	OctoSniff_3.1.1.0.exe
3464	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

OctoSniff_3.1.1.0.exetaskmgr.exe

description	pid	Process
Token: SeDebugPrivilege	436	OctoSniff_3.1.1.0.exe
Token: SeDebugPrivilege	3464	taskmgr.exe
Token: SeSystemProfilePrivilege	3464	taskmgr.exe
Token: SeCreateGlobalPrivilege	3464	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exemsedge.exe

pid	Process
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exemsedge.exe

pid	Process
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe
3464	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 4596 wrote to memory of 452	4596	msedge.exe	94
PID 4596 wrote to memory of 452	4596	msedge.exe	94
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 4448	4596	msedge.exe	95
PID 4596 wrote to memory of 928	4596	msedge.exe	96
PID 4596 wrote to memory of 928	4596	msedge.exe	96
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97
PID 4596 wrote to memory of 4752	4596	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\OctoSniff_3.1.1.0.exe
"C:\Users\Admin\AppData\Local\Temp\OctoSniff_3.1.1.0.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:436

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4696

C:\Users\Admin\AppData\Local\Temp\OctoSniff_3.1.1.0.exe
"C:\Users\Admin\AppData\Local\Temp\OctoSniff_3.1.1.0.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5008

C:\Users\Admin\AppData\Local\Temp\OctoSniff_3.1.1.0.exe
"C:\Users\Admin\AppData\Local\Temp\OctoSniff_3.1.1.0.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1104

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=OctoSniff_3.1.1.0.exe OctoSniff_3.1.1.0.exe (32 bit)"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0xf8,0x130,0x7ffd06f546f8,0x7ffd06f54708,0x7ffd06f54718
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,5263201195376694815,17073596394092058557,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2264,5263201195376694815,17073596394092058557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2264,5263201195376694815,17073596394092058557,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,5263201195376694815,17073596394092058557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,5263201195376694815,17073596394092058557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,5263201195376694815,17073596394092058557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,5263201195376694815,17073596394092058557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,5263201195376694815,17073596394092058557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,5263201195376694815,17073596394092058557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,5263201195376694815,17073596394092058557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,5263201195376694815,17073596394092058557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,5263201195376694815,17073596394092058557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,5263201195376694815,17073596394092058557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,5263201195376694815,17073596394092058557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,5263201195376694815,17073596394092058557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,5263201195376694815,17073596394092058557,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
  2⤵
  PID:4768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WAN Subsystem\wanss.exe

Filesize
216KB

MD5
919f4a22f473c25abdf76b0bd738dd55

SHA1
a31a55b897e85385842762d470dd7ed5db48942a

SHA256
fc8a11235f8077f937006cad2d1ece3aef3adef21bfb6351d3a2d6676c85a355

SHA512
1ea0ac11a98dbdf7be1add47269b88a9bd3ea96fe3827c9f9bfc94940bce5147de925647d8fc547651a2caa879643ed75384044c10ce02e1f9d984feb9d9ac06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\OctoSniff_3.1.1.0.exe.log

Filesize
496B

MD5
5b4789d01bb4d7483b71e1a35bce6a8b

SHA1
de083f2131c9a763c0d1810c97a38732146cffbf

SHA256
e248cef9500ed6e0c9f99d72a2a6a36955a5f0cfc0725748ef25a733cc8282f6

SHA512
357e18ef30430e4b9cc4f2569b9735b1cd12f934c83162e4de78ac29ba9703b63ddb624ccc22afd5a5868f6e9d91a3c64581846abac22e9625f5b2e3d80b3ede

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6be747e67f6af4847f9306e368bd79ca

SHA1
57ad77b6f47b4b0b18c5b32fc41274b4b463be4a

SHA256
900fc6162b00126ab8ff9ad41352d51c9c30f892f594b395e78cc095e5c5afa1

SHA512
718e40bf14ee1b80af874f54c53230bf8f16a77e5b40d48e91584a58c2cbc6777eeac368930a90dfc4af0a47dadd7cbbdea2ee997c2a129dc02609c507418700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
15433c9b182b85abbab160ae47b04e89

SHA1
7cd4b075accc9faef93c56a6bc4a802acadda808

SHA256
ef0c43a09e49e85b79cf8ef961fabc5a6c54b3b7a2edb4678017315612955560

SHA512
6746636a2766e3259ea3741773c766df189efad3c0763cff31805a8799f3809558a4dee0991745e396d45b005e38cda7d497ab76e3f2dc81348a9552ac46a4ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fce138d78f018627a6b2bd9de0c24995

SHA1
189db5bb818f57ba16a89b772e1eeb9a1bc3df50

SHA256
1053bd0fab2061b2017c3acbeb687e5de51668f2d5a2160190df76fbc65fd8ae

SHA512
0baf437ee9192898612a710539525bba06992d133a82ccd42c08bdc395b6c1d717cb964a5f52ef629b73337b6d9b98d5a6868295320fe890f63afad3566b49e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3a279679aa565f2ad331c3bffc9f456b

SHA1
39698bc243c517bb9c136fc17c2a453645381a40

SHA256
867157063f35d433b8a6e476b6cc538f2ad6d5132fcd78e9aca3fe7eeb4e8067

SHA512
1d5f54f49f6746ba8427312b5c229be91d66c8fcf3711e46141545f82ec1b9b30ce2bf7f19e0dc5fdb3d0deddbc361f0cc8076a2ce24330cf0c34ba6827b6a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b4c119e112b7737954569b46165965cf

SHA1
a6f7deb7d24d98b91f9a4881914c63f143d9465d

SHA256
70822e6c1cd8f70a556d5b2e3e6109345aac250e0e7d37a5cc49a81f864dc0aa

SHA512
9a6a8e7b7d956c3b78ea448fdb2fca8e9045982386477bb2e1ff7ed2d094fb3e70d570e1d4c5eb56b28d6d269f97fed1b141667318b445724d5e4587576cc9eb

Download Submit
\??\pipe\LOCAL\crashpad_4596_LWPINTPVSWGHXBGW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/436-7-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/436-9-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/436-6-0x0000000075202000-0x0000000075203000-memory.dmp

Filesize
4KB

Download
memory/436-0-0x0000000075202000-0x0000000075203000-memory.dmp

Filesize
4KB

Download
memory/436-5-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/436-2-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/436-1-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/1104-12-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/1104-11-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/1104-30-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/3464-26-0x0000021F46E30000-0x0000021F46E31000-memory.dmp

Filesize
4KB

Download
memory/3464-21-0x0000021F46E30000-0x0000021F46E31000-memory.dmp

Filesize
4KB

Download
memory/3464-22-0x0000021F46E30000-0x0000021F46E31000-memory.dmp

Filesize
4KB

Download
memory/3464-23-0x0000021F46E30000-0x0000021F46E31000-memory.dmp

Filesize
4KB

Download
memory/3464-24-0x0000021F46E30000-0x0000021F46E31000-memory.dmp

Filesize
4KB

Download
memory/3464-25-0x0000021F46E30000-0x0000021F46E31000-memory.dmp

Filesize
4KB

Download
memory/3464-27-0x0000021F46E30000-0x0000021F46E31000-memory.dmp

Filesize
4KB

Download
memory/3464-17-0x0000021F46E30000-0x0000021F46E31000-memory.dmp

Filesize
4KB

Download
memory/3464-16-0x0000021F46E30000-0x0000021F46E31000-memory.dmp

Filesize
4KB

Download
memory/3464-15-0x0000021F46E30000-0x0000021F46E31000-memory.dmp

Filesize
4KB

Download
memory/5008-14-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/5008-10-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/5008-8-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download