40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
Size

1.3MB
MD5

6ba9bf7ec218b9a52b53472e9e3a1b4b
SHA1

f89db2595d58d437ce4b91075cfbbdb622e571a7
SHA256

40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c
SHA512

7f3cf6bb5163e5128cead2030c4fbbd79e7bd54d9ebad25dcc7f645e97c74952c336e3f34dc6ae72dc04f158a0b3693d6aa7a46fb871f84cd52081db6f7e44fb
SSDEEP

24576:Qak/7Nk4RZPQUKZu0zoFmDcpii9iGn+66rLfJIgtEqPILWz8oDqE:Qak/BQJZu+k0WdEacJRIo+E

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe

description	ioc	process
File opened (read-only)	\??\U:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\B:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\G:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\H:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\L:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\M:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\S:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\T:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\K:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\O:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\Y:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\Z:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\E:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\J:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\Q:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\W:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\X:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\A:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\I:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\N:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\P:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\R:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
File opened (read-only)	\??\V:	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2264	msedge.exe
2264	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
736	identity_helper.exe
736	identity_helper.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid process

116 msedge.exe
116 msedge.exe
116 msedge.exe
116 msedge.exe
116 msedge.exe
116 msedge.exe
116 msedge.exe
116 msedge.exe
116 msedge.exe
116 msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe

description	pid	process
Token: SeDebugPrivilege	1396	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
Token: SeDebugPrivilege	1396	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
Token: SeDebugPrivilege	4604	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
Token: SeDebugPrivilege	4604	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exemsedge.exe

description	pid	process	target process
PID 1396 wrote to memory of 4604	1396	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
PID 1396 wrote to memory of 4604	1396	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
PID 1396 wrote to memory of 4604	1396	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
PID 4604 wrote to memory of 116	4604	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe	msedge.exe
PID 4604 wrote to memory of 116	4604	40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe	msedge.exe
PID 116 wrote to memory of 1520	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 1520	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2288	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2264	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2264	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2124	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2124	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2124	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2124	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2124	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2124	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2124	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2124	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2124	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2124	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2124	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2124	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2124	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2124	116	msedge.exe	msedge.exe
PID 116 wrote to memory of 2124	116	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
"C:\Users\Admin\AppData\Local\Temp\40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Users\Admin\AppData\Local\Temp\40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe
  "C:\Users\Admin\AppData\Local\Temp\40a7858ba2e8585a3e80572ada513fbc5dfc822d2d2846172574a7547ef8e48c.exe" Master
  2⤵
  - Drops file in Drivers directory
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3e7746f8,0x7ffa3e774708,0x7ffa3e774718
      4⤵
      PID:1520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16038561186937167694,15266193955936580850,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16038561186937167694,15266193955936580850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16038561186937167694,15266193955936580850,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16038561186937167694,15266193955936580850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16038561186937167694,15266193955936580850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16038561186937167694,15266193955936580850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16038561186937167694,15266193955936580850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16038561186937167694,15266193955936580850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16038561186937167694,15266193955936580850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
      4⤵
      PID:820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16038561186937167694,15266193955936580850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
      4⤵
      PID:4000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16038561186937167694,15266193955936580850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16038561186937167694,15266193955936580850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16038561186937167694,15266193955936580850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16038561186937167694,15266193955936580850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
      4⤵
      PID:1724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16038561186937167694,15266193955936580850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:1
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16038561186937167694,15266193955936580850,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5552 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2efcb1c8d75bf61dce10c084d1303716

SHA1
be5d833023540a02e8c5abc3cf1815e01a07fb77

SHA256
eca269f53721ebe048bfa890ac223ba094c0735b20a89e18be79a56d6441be27

SHA512
03f8e3d8720b30e3f30f21d4ce3a3cad1cd72d5e2c58869c2c339d6af7e040e330b3c46cef02a42a3966c994034e024b244beba7850b041d53f64cd08a1116d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
43e3f193da09e5976387ade8e877d0c6

SHA1
36c40001b5d42c1af01cfef84c69663f8028895f

SHA256
5597dc80d66c7dccbf2ea57acf3a2d32b80bae39eb1d1d6a363a68c531f1401d

SHA512
d8578c049956d56ae8d8aef3a98c5889c5ca23d671346b72c88c6eaae40e60258dc485e22b72f4a4a499175ff7c06694b5ca9633b7c2601ffc288d779814d7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7bdc7a6ecfb2702c0f416b6ce00b0b47

SHA1
efac478db53b9f944c6fc25fd33f765c9857cb71

SHA256
916338a1461035eaeeade00e53ee522c5cad40a11ee1bfb445007dcb09abed7b

SHA512
c712e53f69318c78b83596766ad7009765ea6ca55e6f59ce878ab16cfb45a1a71ee3169db0c48e7cdf612fb23f304707aa075cf0c7e61ec78affbbfa416b811e

Download Submit
\??\pipe\LOCAL\crashpad_116_DKSBVOAKMMMKYYIE

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1396-3-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/1396-5-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/1396-12-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/1396-0-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/1396-1-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/1396-2-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/1396-4-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/4604-10-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/4604-20-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/4604-17-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/4604-16-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/4604-13-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/4604-8-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/4604-9-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/4604-7-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/4604-6-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download