9621c66f95d1655a902c243678c2c7c2935b8129bb0d1182de9737f6f97ff758

Analysis

max time kernel
114s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2024, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9621c66f95d1655a902c243678c2c7c2935b8129bb0d1182de9737f6f97ff758.exe
Size 3.2MB
Sample241113-rytghatfnl
SHA256 9621c66f95d1655a902c243678c2c7c2935b8129bb0d1182de9737f6f97ff758
MD5 a124beca3e2be56067e5c650827566cd
SHA1 0fd93e74bae16ce123812ecdbf8f847c0e2205e6
SHA512 de57801b439e4f90d4aa9721e101611317beda37214fbe34c20427487459d84bd178f5906cc8e29cfb417b99bd0999ef16bc9d5c17c1742014fcc5b8cb06d9db
SSDEEP 49152:dVAbwDFlvdlIZxaYvglsv24uJcMuR7wHaSMsas5TuUlJ8RZ6y56bKJqKqcCv5:7AUdM7vgKuJVuR8H+fsQuydVqc8
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
3584	setup.exe
3980	setup.exe
3024	setup.exe
4264	setup.exe
5044	setup.exe

Loads dropped DLL 5 IoCs

pid	Process
3584	setup.exe
3980	setup.exe
3024	setup.exe
4264	setup.exe
5044	setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	setup.exe
File opened (read-only)	\??\F:	setup.exe
File opened (read-only)	\??\D:	setup.exe
File opened (read-only)	\??\F:	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9621c66f95d1655a902c243678c2c7c2935b8129bb0d1182de9737f6f97ff758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 61678.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
1752	msedge.exe
1752	msedge.exe
3876	identity_helper.exe
3876	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3584	setup.exe
3584	setup.exe
3584	setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 3584	956	9621c66f95d1655a902c243678c2c7c2935b8129bb0d1182de9737f6f97ff758.exe	84
PID 956 wrote to memory of 3584	956	9621c66f95d1655a902c243678c2c7c2935b8129bb0d1182de9737f6f97ff758.exe	84
PID 956 wrote to memory of 3584	956	9621c66f95d1655a902c243678c2c7c2935b8129bb0d1182de9737f6f97ff758.exe	84
PID 3584 wrote to memory of 3980	3584	setup.exe	87
PID 3584 wrote to memory of 3980	3584	setup.exe	87
PID 3584 wrote to memory of 3980	3584	setup.exe	87
PID 3584 wrote to memory of 3024	3584	setup.exe	88
PID 3584 wrote to memory of 3024	3584	setup.exe	88
PID 3584 wrote to memory of 3024	3584	setup.exe	88
PID 3584 wrote to memory of 4264	3584	setup.exe	95
PID 3584 wrote to memory of 4264	3584	setup.exe	95
PID 3584 wrote to memory of 4264	3584	setup.exe	95
PID 4264 wrote to memory of 5044	4264	setup.exe	96
PID 4264 wrote to memory of 5044	4264	setup.exe	96
PID 4264 wrote to memory of 5044	4264	setup.exe	96
PID 3584 wrote to memory of 1752	3584	setup.exe	99
PID 3584 wrote to memory of 1752	3584	setup.exe	99
PID 1752 wrote to memory of 4832	1752	msedge.exe	101
PID 1752 wrote to memory of 4832	1752	msedge.exe	101
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 1976	1752	msedge.exe	103
PID 1752 wrote to memory of 4548	1752	msedge.exe	104
PID 1752 wrote to memory of 4548	1752	msedge.exe	104
PID 1752 wrote to memory of 5104	1752	msedge.exe	105
PID 1752 wrote to memory of 5104	1752	msedge.exe	105
PID 1752 wrote to memory of 5104	1752	msedge.exe	105

C:\Users\Admin\AppData\Local\Temp\9621c66f95d1655a902c243678c2c7c2935b8129bb0d1182de9737f6f97ff758.exe
"C:\Users\Admin\AppData\Local\Temp\9621c66f95d1655a902c243678c2c7c2935b8129bb0d1182de9737f6f97ff758.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\7zSCB350697\setup.exe
  C:\Users\Admin\AppData\Local\Temp\7zSCB350697\setup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Users\Admin\AppData\Local\Temp\7zSCB350697\setup.exe
    C:\Users\Admin\AppData\Local\Temp\7zSCB350697\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.148 --initial-client-data=0x32c,0x330,0x334,0x304,0x338,0x74818c5c,0x74818c68,0x74818c74
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3980
- - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3024
- - C:\Users\Admin\AppData\Local\Temp\7zSCB350697\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSCB350697\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=1 --general-interests=1 --general-location=1 --personalized-content=1 --personalized-ads=1 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3584 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241113143635" --session-guid=abfc5318-1786-4a66-938c-e437fb420802 --server-tracking-blob=MWY0ZjA2N2JjNjVjNTRlMGZlYmU0YjExMjhlYTA1NDIzMjczMWUzNzQ3MmQ2Mjc3NTkzZjM2OTQ5MTAxYmI4OTp7InByb2R1Y3QiOnsibmFtZSI6Ik9wZXJhIEdYIn0sInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fX0= --desktopshortcut=1 --wait-for-package --initial-proc-handle=6C09000000000000
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB350697\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zSCB350697\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.148 --initial-client-data=0x31c,0x320,0x324,0x2f8,0x328,0x72068c5c,0x72068c68,0x72068c74
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller&arch=x64
    3⤵
    - Enumerates system info in registry
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8970346f8,0x7ff897034708,0x7ff897034718
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6799407448692300811,70695861147540948,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,6799407448692300811,70695861147540948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,6799407448692300811,70695861147540948,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6799407448692300811,70695861147540948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6799407448692300811,70695861147540948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
      4⤵
      PID:236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6799407448692300811,70695861147540948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
      4⤵
      PID:4024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6799407448692300811,70695861147540948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:2036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,6799407448692300811,70695861147540948,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3548 /prefetch:8
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6799407448692300811,70695861147540948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
      4⤵
      PID:3876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,6799407448692300811,70695861147540948,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6076 /prefetch:8
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6799407448692300811,70695861147540948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
      4⤵
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6799407448692300811,70695861147540948,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
      4⤵
      PID:368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6799407448692300811,70695861147540948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6840 /prefetch:8
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6799407448692300811,70695861147540948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6840 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6799407448692300811,70695861147540948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6799407448692300811,70695861147540948,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
      4⤵
      PID:5220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 471B
SHA256 806ff911a58fb0aecfd4df102f6c9ed1d6ec0a048d23ca0ba9270c2dd0479917
MD5 cacf133935c340f8f1316b36304584cf
SHA1 66207d7a3d24f8fbfa0c6bf83cf40b17ce5ceadf
SHA512 4a03ebc6f1589e9f70778c88a2bee76a6703250ce6fb641248e61d40aa07640bf0428240fdc0b9a4e0415530d45bd4892546a3447f74c235c27cd4ba51bed8e9
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 471B
SHA256 c8061bcd17712c4e6b160d8951c723eba49fcc920b5cedebb7f663b3877b904d
MD5 359c5a46f67b4bfe5c0218f8389e7c1b
SHA1 fbeff7d884e17f6f1f0f8e72b26081e5e17564cc
SHA512 be78a2ba9e1734259bfb0ff43899a4066c8b9ea3407d1a2f7a6ba64846140918455a846aa2abcc4ea13639b03f8c547481326370f17c35d82bfae7397446373b
MD5 SHA1 SHA512

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 400B
SHA256 ce8dbf6742424a93ebd52be84f046a345e5ddbea20138989dad79fa2f9d7318c
MD5 bc52abb92121dd5bfc4a5d89e29768b0
SHA1 a4a351bf4a12537828a89a7b7805b7780b30c8bf
SHA512 d3f8b38a5e055897961c0eab940b38a4ca045f9103c1bf0e9e97f8078efca23f8b2346e282ecf1ba1cab98b16ee2f1cf4661a2e9cddaffa8a4df694a796aecd1
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 1a51348f62886bc359e8350885ab51ad79de83d9168ff69d3d2f7b7c837995a4
MD5 47253cf111031e8bf3d1f555d72f79de
SHA1 29434de4ac140635b8ffd4dfb8556c8f5961114d
SHA512 b642ec05fb7c1a8ff516c10b6db1f0bfa03f21b9a743668ffa37e99196bf5406679d70d550e8bafbd9b99055361d6b7967fb0fd3918649af273956faf77c7456
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
MD5 61cef8e38cd95bf003f5fdd1dc37dae1
SHA1 11f2f79ecb349344c143eea9a0fed41891a3467f
SHA512 6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
MD5 0a9dc42e4013fc47438e96d24beb8eff
SHA1 806ab26d7eae031a58484188a7eb1adab06457fc
SHA512 868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 fbd813d0918b7ba3c6d3977c169ddce0a17307e93343901ec41051e9e38c9e71
MD5 42e8a20a7b3158a0504778da72cfa6b3
SHA1 477a38721356f8157e3ca022644880a94d3096b3
SHA512 d396e15fd5424e0e77f6c027fec6e5885117dde14dd915af9a6eba00bbdfb8a68235fd6dba3bde9029e85359e3975b0d67c5756ea0d39d12428e57180439a522
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 4ca5a3bb94dbc3921f9ddb050171475eddcba65dd59eeb472c13a5b5b54544f4
MD5 37498c5431fef07b4e403cd662e27e27
SHA1 d38c117a9111ddf1486017ac566908983cc7300a
SHA512 be50c3ee19c7dc55179188fab9b5cdd85842889ea24a1081d0f48ee204c816533f3bc3d1425543c8b75d1cd95184c8284bf5c527afdbe7801a6089964de6c257
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2bb0962689604afb62ebdd4db977ff69ccf687f65fd223854051860206e7c9ab
MD5 a2877f54620b18cc4eac679800b65514
SHA1 9df2e6d1c727f0278fcb4e0d6bbec7978662f328
SHA512 ec545cb911153cf2ebb8fc73691e8bc29fdb33f5d6efa89104da2b294404da2b169c27c56894c305d6d00cdddc459a751b5b1e3d9b145d8b2060bdcdffde695a
SSDEEP 96:nBkAm1YWlwwpvWMoiVmdeH7Ckh+UWQyV+VDCziEwb:nBkTCWlwGWMXT+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 80f19b01c9fddee761bec64e3812aea320ad79bdca8e5e683ee31d84e255719d
MD5 0a2a663e564f9a1f53f94fac5ddca8e7
SHA1 adbf9f3c25060f7ced1df74f444e76dfc41f88c0
SHA512 b6db6400ee5b22633e539fd251705ed166c2fd8955b2636539084cb6c045995646c2163c72f8c28eef57dfe2868f1f7a9aaee99aae964f71b2c4335f240bf4e8
SSDEEP 96:nBk8sQ7m1YOtwwpvWMoiVmde8vuU1/ukBIbjgGmW8L58GvTq7Cqh+UWQyV+VD7AE:nBk1COtwGWMMvuURukBkjsv9FTq3+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7eebf8690a766aadc134d254fcee923537bc09b23c9a7b758aa6f97f61f44c76
MD5 a973f4b9e2bd237de7d0fb3dc3d63822
SHA1 842ce4d80243fb4638bdb79a10f73112f965720e
SHA512 cdee21c4a427e450c7b0c32f47915a969cf3fac93de6c06897e3b1b9b26d47ad7fc5ed86119ffb68b6d138b23b997b85a48c3b096d70d7c115f1cd675cd2808e
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe582640.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582640.TMP
Size 48B
SHA256 51e062d69f64a2701772bcedbdeb8da64957d75bd19d1ba146a0cc523406c5ab
MD5 bee1ed281f4d38ef46a194b342a62406
SHA1 22918f3273ae4dadc5bfcab96f4f187b5d93ae51
SHA512 2d18ad5b63f03b6d313fd2a57b60c5cd3951f2f085f78598cf0ff5499a74d34143d7b776ba1382dc15b0b4ecb6a8146d93d6aaeb1c91a714940de7a07e19cc7b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 acd7b40dff5656c8c45fc7412c0ea9e9764beb0e8af7ee50062e0096ba9b504a
MD5 6785b090b2460ed85338ed70f5b83ce0
SHA1 780fb0500ea31143f6bd3197ea83f6979aa0c15a
SHA512 1bc132f8846a8bba35af90a79c084f7703adc1468f3d9faddf3fa03a2bfb1e2a13225d931ae78d12af2789d1d32337b8ced66cea8086c94050c0e45cf452ac7f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupm5oe2RUf4nDOHqRUx3GPOk:A9iIxuERzA83h09RZxYm5G5RSFGmx8om
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCB350697\setup.exe
Size 6.5MB
SHA256 5212cdc05c4fcb27eb3ae875f832325712332502b050c53a2f5fd9203704e82a
MD5 aa8de37a3f32a758576276274af93a5b
SHA1 deb4c92641dfe8f6df1854b5282238892a1df242
SHA512 2db127cf8127e15a6fa2aec095e0eb2bea2ff73bd3629b46623f3266d8578c63403a39efe451ebc09180d182dd460ebfa8f15e1d681a2e4e583058955a47850c
SSDEEP 98304:X+hx5g6666666666666666666666666666666x666666666666666fwwwwwwwwwA:WSJmoDdtRFsg5uwx1jh6Uons2CRDw8L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opera_installer_2411131436350933584.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2411131436350933584.dll
Size 6.0MB
SHA256 7b3eb216622879455c362d8c85a946e4873f6ece3bfbff2366d310fa2a5cc9d3
MD5 1f2c45ffb791ccb0e071fb94133fea52
SHA1 07c3d8bf6d5245e6cc7213591302c5f8a42dfe37
SHA512 6b046e660f0d870e928819691e34e5235b85de1d826c3e8ee71b91106303185f60aaecd5c6bf973df3d623cef0ed48f663166a12650267cc8eb02bae7776d60f
SSDEEP 98304:t6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwL:kSJmoDdtRFsg5uwx1jh6Uons2CRDw8b
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 7ec3853fdb713bdf1d869a37476a823b8ebb1f2ca2b26064140013009448f01d
MD5 e8de0048a6a4c90575a4b7d59f757a17
SHA1 0bdd528b483b36c27fde6835a80f6c9f11699e2d
SHA512 51fc4a3d3806844d1dfb4a71fef8abb952fe3e46b7621d1292120cee8a060a1fc3553954c46280a2608c360ef7ad555338640f6d1a9153fc1d229a7033eb5c19
MD5 SHA1 SHA512

Submit Download