ramnit | 527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922f

Analysis

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2024, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922f.exe
Size 3.6MB
Sample241118-ym23tsypcl
SHA256 527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922f
MD5 8c4277097a4f026d4e5e6bdcfe26422d
SHA1 d7596d836b399712622a442c56f580039ee8a4d2
SHA512 333e8f14fae057b92298ff907e22a3de029a0a8abcb560c2031386f7d2197d41d31ac179c07b5a924e544770fc10eef780e367ad72419e02e65d9e8494e4ea0c
SSDEEP 98304:1HtK2afnf1W7ojMl9b52e4UF4qFmLSYYWo4r8eJZNKDQT9:7ava9sU5ZWo4r8eJDKU9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker bootkit discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
464	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922fSrv.exe
4372	DesktopLayer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922f.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023cbb-4.dat	upx
behavioral2/memory/4372-16-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/4372-20-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/464-6-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\pxC0C0.tmp	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922fSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922fSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922fSrv.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922fSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31144435"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31144435"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{04AD5F9C-A5E7-11EF-A4B7-D6A59BC41F9D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438724686"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3654482345"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3643293803"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31144435"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3643293803"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4372	DesktopLayer.exe
4372	DesktopLayer.exe
4372	DesktopLayer.exe
4372	DesktopLayer.exe
4372	DesktopLayer.exe
4372	DesktopLayer.exe
4372	DesktopLayer.exe
4372	DesktopLayer.exe
1008	msedge.exe
1008	msedge.exe
3628	msedge.exe
3628	msedge.exe
2264	identity_helper.exe
2264	identity_helper.exe
5312	msedge.exe
5312	msedge.exe
5312	msedge.exe
5312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3992	iexplore.exe
2332	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922f.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
2332	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922f.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2332	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922f.exe
2332	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922f.exe
2332	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922f.exe
3992	iexplore.exe
3992	iexplore.exe
4656	IEXPLORE.EXE
4656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 464	2332	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922f.exe	83
PID 2332 wrote to memory of 464	2332	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922f.exe	83
PID 2332 wrote to memory of 464	2332	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922f.exe	83
PID 464 wrote to memory of 4372	464	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922fSrv.exe	84
PID 464 wrote to memory of 4372	464	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922fSrv.exe	84
PID 464 wrote to memory of 4372	464	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922fSrv.exe	84
PID 4372 wrote to memory of 3992	4372	DesktopLayer.exe	85
PID 4372 wrote to memory of 3992	4372	DesktopLayer.exe	85
PID 3992 wrote to memory of 4656	3992	iexplore.exe	86
PID 3992 wrote to memory of 4656	3992	iexplore.exe	86
PID 3992 wrote to memory of 4656	3992	iexplore.exe	86
PID 2332 wrote to memory of 3628	2332	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922f.exe	95
PID 2332 wrote to memory of 3628	2332	527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922f.exe	95
PID 3628 wrote to memory of 5040	3628	msedge.exe	96
PID 3628 wrote to memory of 5040	3628	msedge.exe	96
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 316	3628	msedge.exe	97
PID 3628 wrote to memory of 1008	3628	msedge.exe	98
PID 3628 wrote to memory of 1008	3628	msedge.exe	98
PID 3628 wrote to memory of 3116	3628	msedge.exe	99
PID 3628 wrote to memory of 3116	3628	msedge.exe	99
PID 3628 wrote to memory of 3116	3628	msedge.exe	99
PID 3628 wrote to memory of 3116	3628	msedge.exe	99
PID 3628 wrote to memory of 3116	3628	msedge.exe	99
PID 3628 wrote to memory of 3116	3628	msedge.exe	99
PID 3628 wrote to memory of 3116	3628	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922f.exe
"C:\Users\Admin\AppData\Local\Temp\527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922f.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922fSrv.exe
  C:\Users\Admin\AppData\Local\Temp\527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922fSrv.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4372
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3992
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3992 CREDAT:17410 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ssd-life.com/eng/why-ssd-not-found.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8205446f8,0x7ff820544708,0x7ff820544718
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6443946831836507597,11638378445915394570,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,6443946831836507597,11638378445915394570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,6443946831836507597,11638378445915394570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6443946831836507597,11638378445915394570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6443946831836507597,11638378445915394570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6443946831836507597,11638378445915394570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6443946831836507597,11638378445915394570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6443946831836507597,11638378445915394570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6443946831836507597,11638378445915394570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6443946831836507597,11638378445915394570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6443946831836507597,11638378445915394570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6443946831836507597,11638378445915394570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6443946831836507597,11638378445915394570,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 471B
SHA256 7f877563622aeda07395133fb7c81746df3389c360549e2309c161c8a394d9bf
MD5 cdfebcd84ff934bb577a1d3a07a3ccad
SHA1 5092f452374bb3943b00cf53bcad7a92215bae87
SHA512 605a455017dc67d6257a5b434ce9a8df8fbac30dcf6e45856c823ee9998f4008ae08947129a23d88c222c866a06192c2e75374880fe8b67d591816492ae4f56b
MD5 SHA1 SHA512

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 404B
SHA256 6c5bdf88d7e6f319ef7a07d81681db80cd16e6798448ea1d0621c56e0d0e0b82
MD5 83f91f6909932f123129d197c6ebca3c
SHA1 365e96c2ac87ab3b084127a4965c1fb2c560e87e
SHA512 fa29cab0762f65c3fe25987fd40ba9bb0d76b10fad9f7e252b5c97e555546a11ce57d15fc418f82a68888270c08edbf36bb2d564ac38cedf573b96f4b73ab593
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b
MD5 e443ee4336fcf13c698b8ab5f3c173d0
SHA1 9bf70b16f03820cbe3158e1f1396b07b8ac9d75a
SHA512 cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb
MD5 56a4f78e21616a6e19da57228569489b
SHA1 21bfabbfc294d5f2aa1da825c5590d760483bc76
SHA512 c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 bf356bf0b8b8941706beab16149d2e860f01f68a287481722a0968f575459818
MD5 5a307d16eff3ffa6ddc33fc51a362f77
SHA1 60fa0c696dbd8b473b7c9806884697a5f9ae046f
SHA512 b52b28874008879474fb57a0676a19238f9d29c6bdc4a0e112310d2b0395fd23e85b151df6e39f59bb4520b84a202d5c594930403a1560cd0010f6faeec20469
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 ee822dd11b8fb9a365f412675fc79f12c0139778f6ad7156e5c9d86ab719f238
MD5 92477df996969a2afae27a66d2cc6e12
SHA1 2df83ed63863d999ea0592c3b02495dbc96c1a3a
SHA512 8802d97af43f770d2eae795d623ce07420418c7b530700ba5035c755ecc23f86c5f265b9bb2cb53d4a0cfa1f06c1aa42bf2e017bd3137e7769f84fe325651a57
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a7afd17f8709db1b88ac4e9e0a1805e18642abb6f5673ffdec67b54e85c6ec6a
MD5 3d6ad9419e4e0398840a09a3ee5d155e
SHA1 dfd3787e8a6378c31376b378869e64d823370dfd
SHA512 3b0b6e30eb32a2bb789a40f8417de48186fa16905ae2344b2bbaa646613f44fa29599b7e6b20a3ea85cc3ec7e75b730809eed7252275240e2efa5c86f69ea6da
SSDEEP 96:nVk8r1YOwpvWMoiVmdemtuHB1qbekEVmn2Pyu6QUWQyV+VD7AiEwb:nVkGuOGWMguh4blEVmn2+Qrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 67991f2d44ea27faba04f0cc952f7c205cd2295123f056e10f636f24e09066a4
MD5 99c450ec833f8ec821b6d0dd80906901
SHA1 24c2668c3c2e7d83919857f689551bb63a99c8ff
SHA512 5b83327143a85eb5381774b3827fbf3128b499700ba5e306991e042f45b1e1bcc5e7f286369032443ef6ef68d88af52eb5517c271a12225e9ff1256123c04165
SSDEEP 96:nVkZr1YDwpvWMoiVmdeHPA6QUWQyV+VDCziEwb:nVkduDGWMXZQro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 1d848f15b243a283f60e0778b9cf12cd0e29d7243a2ea249dd1d8046d11808ae
MD5 0825b381749a8fc4e1a99d46024148ed
SHA1 95812ce9b6e0025c2b3a09deee31b437164866b1
SHA512 1922db13520a9d35a9f12132c7c1cfdca6ba5de9110a04d8184b2b23fe7db81c3cc74210c664062b004d7be4f3320aca5f41934b49fc5cbc0506974013dd01d1
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5857a1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5857a1.TMP
Size 1KB
SHA256 a7646125835473cf9eb9cff454f678fc9cfa822e88af0dc48174938473087068
MD5 416cf1d0f1edb3c949eaa3ec7ba04646
SHA1 6f0e33f82474dd5a754d39851cec843fb0ca777e
SHA512 39db90b2a48a5eb535f72a2ba70e321f53ded914f0acc5e1e01981b3d7c5422043e3b75b4a91e7a9c73ebc9a9e0b3df6ba319cd645edbc43cb3cc2a5c0f3b17a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 d0470c80df467fada28ffd1d501cf28fc0922928e62e6ce224182051571cf746
MD5 591aecdb9110a1777b6c234a2597d7cc
SHA1 bf67646234fc6fde13b163bdeceaf999987aea2d
SHA512 8923f9c4d2ebbf22c918037a76345e1075a64f61f030176a26dad95f454841b671020aa4414e99f22b6c355814d69bd684780fc5e113658e3bd3218913695f8c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupTiCUe2RUz8mhYdF980JQwT:A9iIxuERzA83h09RZxYTAMhYi0Yvu
MD5 SHA1 SHA512 SSDEEP

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P2UT3MS5\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922fSrv.exe

Path C:\Users\Admin\AppData\Local\Temp\527dc0e6043c72a4458436084d9d83de5b5f5d14e4a879eac1175febad6d922fSrv.exe
Size 55KB
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
SSDEEP 1536:Q+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzE:bROzoTq0+RO7IwnY
MD5 SHA1 SHA512 SSDEEP

Submit Download

laC10E.tmp

Path C:\Users\Admin\AppData\Local\Temp\laC10E.tmp
Size 44KB
SHA256 b75e4a842e13e09999531a71691439423cd99c26e0be5bedd1714539073ca58c
MD5 efcad9828a2eb5d476e6d83261322778
SHA1 30508791e0e5f57e2826d9803b387a17da5bfbe8
SHA512 6dcb5c00d99aefcf3e104ff8dd768bac782421e859deb06a7b0fa5c388bcffe309d9f47285bbdbde373066f64824e5a9654646c7a19d7a44940af94db5c38452
SSDEEP 768:0VfUdDT9HA4yQqMehixz7hEoE4sVnsc13KXjP+ezFzf/Xf62Oexh60j78qb:wYn9g4y7iB2oun4XL7B3Jhj0qb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/464-7-0x0000000000550000-0x000000000055F000-memory.dmp

Download

memory/464-6-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2332-0-0x0000000000400000-0x0000000000AE2000-memory.dmp

Download

memory/2332-38-0x0000000000400000-0x0000000000AE2000-memory.dmp

Download

memory/4372-16-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4372-20-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4372-19-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download