c2d5a4f79f1f9ee3b75ed2ea17a1a56aca439c8227c7a9d2cf6d284948583133

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2024 08:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2d5a4f79f1f9ee3b75ed2ea17a1a56aca439c8227c7a9d2cf6d284948583133.exe
Size

3.1MB
MD5

94eb2dd61abb0eb7b9e6db46687dbab1
SHA1

6ad3fe1c3384bd90063855a5925493fec045afa2
SHA256

c2d5a4f79f1f9ee3b75ed2ea17a1a56aca439c8227c7a9d2cf6d284948583133
SHA512

2c61c9dc16a6560a3941cb8ffe77e3b9f21a6bf69559278b16a2caa7c6f698b08c497091db28ca20958abffaf08e5da1779b90adce5193fbd0bee160b34521a6
SSDEEP

98304:wAyXe7ykegiTNpjQpSI14jSKQoDXAy0YbJ31nu2Cmh:IXe7tiTHjY4jS1sXA/mJ5u2nh

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
2724	setup.exe
2968	setup.exe
4956	setup.exe
4020	setup.exe
1252	setup.exe

Loads dropped DLL 5 IoCs

pid	Process
2724	setup.exe
2968	setup.exe
4956	setup.exe
4020	setup.exe
1252	setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	setup.exe
File opened (read-only)	\??\F:	setup.exe
File opened (read-only)	\??\D:	setup.exe
File opened (read-only)	\??\F:	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2d5a4f79f1f9ee3b75ed2ea17a1a56aca439c8227c7a9d2cf6d284948583133.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 413364.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
860	msedge.exe
860	msedge.exe
4992	msedge.exe
4992	msedge.exe
2612	identity_helper.exe
2612	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2724	setup.exe
2724	setup.exe
2724	setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 2724	4780	c2d5a4f79f1f9ee3b75ed2ea17a1a56aca439c8227c7a9d2cf6d284948583133.exe	86
PID 4780 wrote to memory of 2724	4780	c2d5a4f79f1f9ee3b75ed2ea17a1a56aca439c8227c7a9d2cf6d284948583133.exe	86
PID 4780 wrote to memory of 2724	4780	c2d5a4f79f1f9ee3b75ed2ea17a1a56aca439c8227c7a9d2cf6d284948583133.exe	86
PID 2724 wrote to memory of 2968	2724	setup.exe	88
PID 2724 wrote to memory of 2968	2724	setup.exe	88
PID 2724 wrote to memory of 2968	2724	setup.exe	88
PID 2724 wrote to memory of 4956	2724	setup.exe	89
PID 2724 wrote to memory of 4956	2724	setup.exe	89
PID 2724 wrote to memory of 4956	2724	setup.exe	89
PID 2724 wrote to memory of 4020	2724	setup.exe	94
PID 2724 wrote to memory of 4020	2724	setup.exe	94
PID 2724 wrote to memory of 4020	2724	setup.exe	94
PID 4020 wrote to memory of 1252	4020	setup.exe	95
PID 4020 wrote to memory of 1252	4020	setup.exe	95
PID 4020 wrote to memory of 1252	4020	setup.exe	95
PID 2724 wrote to memory of 4992	2724	setup.exe	96
PID 2724 wrote to memory of 4992	2724	setup.exe	96
PID 4992 wrote to memory of 1240	4992	msedge.exe	99
PID 4992 wrote to memory of 1240	4992	msedge.exe	99
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 2088	4992	msedge.exe	100
PID 4992 wrote to memory of 860	4992	msedge.exe	101
PID 4992 wrote to memory of 860	4992	msedge.exe	101
PID 4992 wrote to memory of 5088	4992	msedge.exe	102
PID 4992 wrote to memory of 5088	4992	msedge.exe	102
PID 4992 wrote to memory of 5088	4992	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\c2d5a4f79f1f9ee3b75ed2ea17a1a56aca439c8227c7a9d2cf6d284948583133.exe
"C:\Users\Admin\AppData\Local\Temp\c2d5a4f79f1f9ee3b75ed2ea17a1a56aca439c8227c7a9d2cf6d284948583133.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\AppData\Local\Temp\7zSCA25E597\setup.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCA25E597\setup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Users\Admin\AppData\Local\Temp\7zSCA25E597\setup.exe
    C:\Users\Admin\AppData\Local\Temp\7zSCA25E597\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.115 --initial-client-data=0x32c,0x330,0x334,0x308,0x338,0x74091b54,0x74091b60,0x74091b6c
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2968
- - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4956
- - C:\Users\Admin\AppData\Local\Temp\7zSCA25E597\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSCA25E597\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2724 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241031081800" --session-guid=0c5396cb-5cc3-4bb2-9c6b-bbc78700e349 --server-tracking-blob=MWY0ZjA2N2JjNjVjNTRlMGZlYmU0YjExMjhlYTA1NDIzMjczMWUzNzQ3MmQ2Mjc3NTkzZjM2OTQ5MTAxYmI4OTp7InByb2R1Y3QiOnsibmFtZSI6Ik9wZXJhIEdYIn0sInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fX0= --desktopshortcut=1 --wait-for-package --initial-proc-handle=2009000000000000
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\7zSCA25E597\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zSCA25E597\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.115 --initial-client-data=0x31c,0x320,0x324,0x2f8,0x328,0x71901b54,0x71901b60,0x71901b6c
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
    3⤵
    - Enumerates system info in registry
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9926b46f8,0x7ff9926b4708,0x7ff9926b4718
      4⤵
      PID:1240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2252710104161021647,5857580870035254952,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,2252710104161021647,5857580870035254952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,2252710104161021647,5857580870035254952,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3040 /prefetch:8
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252710104161021647,5857580870035254952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252710104161021647,5857580870035254952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252710104161021647,5857580870035254952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252710104161021647,5857580870035254952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
      4⤵
      PID:2292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,2252710104161021647,5857580870035254952,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5812 /prefetch:8
      4⤵
      PID:760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252710104161021647,5857580870035254952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2140,2252710104161021647,5857580870035254952,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6252 /prefetch:8
      4⤵
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252710104161021647,5857580870035254952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
      4⤵
      PID:404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252710104161021647,5857580870035254952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
      4⤵
      PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2252710104161021647,5857580870035254952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6924 /prefetch:8
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2252710104161021647,5857580870035254952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6924 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252710104161021647,5857580870035254952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252710104161021647,5857580870035254952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2252710104161021647,5857580870035254952,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5912 /prefetch:2
      4⤵
      PID:640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
471B

MD5
c8c8db92f7cd7aa2e5deefa27127451e

SHA1
8c7a6b67771e0937cd1be62deb48cc5582182b08

SHA256
f2ad2a102162e9ef032e3afa9b759ecbf7354e270768dcfcc62a84fbb8b54aaa

SHA512
fd9f03dc7fa9ae5c52c375a17c5afd2efc5b7b1586c6122ce1a7e715fd2c4ebdaaac6803b2ade829a71c3b6c64448696ac764734efced87bcaa8884f9e0fc7b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
471B

MD5
037a1a1eed877c520ec2d8e877a0ef10

SHA1
2c261667a88ca76c700cf61c24167d6185f164b8

SHA256
04f352b4d334a645a09a76772ff766ee4ae359754a056d08f5772895a703cc7e

SHA512
021cf980ecf3cdc259caadb470a5557d8b0ac13d34185e8e4bb22693e26b7ce01ee5fcc833177d921635e8da3a6cb72e9133c5a6e786056db71969b515814bbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
400B

MD5
4a9247e0a73a1f0d7115a7ff5ea3fe30

SHA1
21b4c25df5521d2343e257bcde3f3408e39bbd7f

SHA256
e88bad54aa5d90934f32293d48cd457fbac1b64d0c266d85b2c117ee509ff36b

SHA512
c34a3cfbb0e719e0a29b01397490554aa17555cc95c6258d0c4ad777639ab4ad4c700aa594604973be6aa7e931147e834660927187d40d31014f4ff9271bbd19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
412B

MD5
8f0c7e56d5a9ceee1af26cab21aeef83

SHA1
e28d9090fd064eded982bc051caba3ba5f0cc91e

SHA256
c09813f15a9abcdde61b6594b2b8c708306caf0aa04f36a6781bb176bbf6d60b

SHA512
edfdd5d3c4caf10b21fbdbbf66230183ca5e730dbe5c2a618274b856d7f3d7a2bf0015d556fc02cfc5c99712cbc6d271603f5a8dca3d48c2b86d2836b0a03e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
3fc9341a32fe9db4bb5377796e387abb

SHA1
0dcc7f2ab67bb39c0675ebd56c21ffd54b111d73

SHA256
f1523e0ff764e9424037580ea24dac351463b4f7233f4f97624be2260971e191

SHA512
b6a3be748c4422397668cbf61c925edb087ea092c4f00377d13873377028580e862c4dd879daa34bbe57c6f7208a828d60440076bf99b8e6d12041def157db3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0928e7140bfe58631a11c58ad4b020ed

SHA1
9c9afba93d36e88a85160ddffb1b8abd62231eca

SHA256
32aeb9fb5c8607b45a63a335db87952abbe51bd047509f920b0d2b5938bf27af

SHA512
fe279e933a607d225930a2d7c7c7e2def5a660b7ba9fbb29bf9f62782fe68a4062241ebc7c5befd1038c48a8990049078b89555b5e971b4907cf38deefabccdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ab86e2d405afa4f04d021150c5f76ef2

SHA1
1e3b8dad94e906199052e2f504f29c5b0942cf63

SHA256
6549a912720621d8e1d7e2e3830dfea500b81e6245149612e749a42ff4e359ef

SHA512
2d7d92012bf3689701b3a18db9854bed317b0d0ddbc7f60b15e9234d826807265a75d5af7349020fb4c70c88b551ebdc5ad5e0fc925956deb923a2f5948662ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da2a9f988b810b771fef3ebbb9e2ef4e

SHA1
af836823e37484878c956f6c15a3997cd0ca8c66

SHA256
d53fd15050e4f9f3889a8553576e08e79b51a303117fbfbe2e7b3531d337b2e4

SHA512
afbc4842308a7c8e8667121509783544ac31f47e8c490b7361c6f7865c8e43f579c89fbbc3482324f2f19103ef127c24ba5503caf8f8aecdf65c64d1531b63f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
088bbf3ecd8d19b0720a64535b4f831d

SHA1
b55819ee428acb98bf5dea4e4d6cc078e299ddc2

SHA256
ed52815b666339f5763edda421fd96aa6de72d5c4b117dc7eca807717e0de828

SHA512
298b7c54fac9b127b4dc2fc599c3438733251d9f0b77af8dc8f6d91c8f2d718486c975878db813630bf9f1398554df5f117ab52ce3dc66a8856ffe6563567171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582844.TMP

Filesize
48B

MD5
dbf3e1343040842f2fa655778f209f2f

SHA1
75edfecb299b358e255f755c2240e4b54a10d657

SHA256
e58687a4a187cb592decf44512ad1e08ddbb2883edb6bb32ded2d8678384570c

SHA512
4fdef8245e63c2530b71655e5d79376e858482e9899dc67c632d5a6c2660c49295cd42586938f7d5437640d406993186cbb276985a45af31285482edd124ca61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e15acd92-cee3-4267-a522-875b6c155fb1.tmp

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6c9e454c73900e38de478262c6cb8dfa

SHA1
d98e7850f28431bcf12fbbcc341b7eb1282ddf6f

SHA256
1cc788f3fdaee0f2fd5d8ce1014c1e3538007568aee567fbfe94f4dcb33fddf6

SHA512
e47a024eca0cc0326c0959527c790f1884987af7deb1e11020acb0e7f06f6f923871e3910e30e7201fd3fee59692a20c126766ddc4e1e2c7e7500b61ce8a11b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCA25E597\setup.exe

Filesize
6.4MB

MD5
defd30ea336650cc29c0c79fad6fa6b5

SHA1
935d871ed86456c6dd3c83136dc2d1bda5988ff3

SHA256
015a13bd912728e463df6807019b1914dffc3e6735830472e3287150a02e13f4

SHA512
8c6ebbf398fb44ff2254db5a7a2ffbc8803120fa93fa6b72c356c6e8eca45935ab973fe3c90d52d5a7691365caf5b41fe2702b6c76a61a0726faccc392c40e54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2410310817583032724.dll

Filesize
5.9MB

MD5
640ed3115c855d32ee1731c54702eab7

SHA1
1ac749b52794cbadfec8d9219530e9a79fc9427c

SHA256
29b4cabc7a0e9dffbc2395b976749be0aad88357dd3b1d7e0cfc9b0c645421a3

SHA512
bebe55fdbb363b78c4a6371304f65b89e03a03cee5a8ebceee1681261d8df64a0de36888ed763c3a607ae2732ab54e2e41edb624f37a7fdf8755c40e6bb96f53

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

Filesize
40B

MD5
c62bfaa8723f5cb98b027ceeff613194

SHA1
bca01f2cb92f026472b3a58551275889b0fb75f0

SHA256
1d2907c1defc5ec9f3ca23f142a98451804bd56f5d65f5dcc5efa8b6745a3e75

SHA512
f0f43b3cfa5de9d60123429c8cbaad549453cbdf4bd4b95db9927c81fb055dcddca9fab9533f49cf5c9eeee041fff647f23290227569e95a14dd7ddf4994bb51

Download Submit