xenorat | 76c45fabe4e4438e1d9d434e9cd104219fc7e855b90bafaf52b70c069a495b65

Resubmissions

30-11-2024 03:09

241130-dnx52syqcw 10

30-11-2024 02:55

241130-derxnssrbq 10

Analysis

max time kernel
220s
max time network
266s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.exe
Size

163KB
MD5

4531671a39dfdd4a9711e64400f7f0fa
SHA1

55357cd9c957105f9b5af04f1a8e65101229ae4a
SHA256

76c45fabe4e4438e1d9d434e9cd104219fc7e855b90bafaf52b70c069a495b65
SHA512

d35d54d6986dfbe22fcac76792853cacdc1c4b0eecba5cd7703c3b1f50005d42b8e36ccc6a8c5a4928d2c49413896e11779f4e23357b7229b0863511f5ab3f52
SSDEEP

3072:O6kZB/A8p+F3sh+3NB/fXdBcRDmGCKX+Ip4rI4gei6+SRaBwV0BfI6Ks2:hkZB/A8p+F2+3b/fXdKcLKXhG84geVoP

Score

10^/10

xenorat discovery rat trojan

Malware Config

Extracted

Family

xenorat

10.160.192.195

Mutex

Attributes

delay
5000
install_path
appdata
port
13579
startup_name
Windows CL

Signatures

Detect XenoRat Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c9c-5.dat	family_xenorat
behavioral1/memory/5052-9-0x0000000000A80000-0x0000000000A92000-memory.dmp	family_xenorat

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Xenorat family
xenorat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\test.exe	test.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\test.exe	test.exe

Executes dropped EXE 4 IoCs

pid	Process
5052	tempfile
1576	tempfile
4072	test.exe
1272	tempfile

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\tempfile	test.exe
File created	C:\Windows\system32\tempfile	test.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2056	3048	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tempfile
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tempfile
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tempfile

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	tempfile
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1716	msedge.exe
1716	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4384	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3032	unregmp2.exe
Token: SeCreatePagefilePrivilege	3032	unregmp2.exe
Token: SeShutdownPrivilege	3048	wmplayer.exe
Token: SeCreatePagefilePrivilege	3048	wmplayer.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
3048	wmplayer.exe
3048	wmplayer.exe
3048	wmplayer.exe
4760	helppane.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of SetWindowsHookEx 53 IoCs

pid	Process
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4384	OpenWith.exe
4760	helppane.exe
4760	helppane.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 5052	1588	test.exe	83
PID 1588 wrote to memory of 5052	1588	test.exe	83
PID 1588 wrote to memory of 5052	1588	test.exe	83
PID 4384 wrote to memory of 3048	4384	OpenWith.exe	102
PID 4384 wrote to memory of 3048	4384	OpenWith.exe	102
PID 4384 wrote to memory of 3048	4384	OpenWith.exe	102
PID 3048 wrote to memory of 1680	3048	wmplayer.exe	105
PID 3048 wrote to memory of 1680	3048	wmplayer.exe	105
PID 3048 wrote to memory of 1680	3048	wmplayer.exe	105
PID 1680 wrote to memory of 3032	1680	unregmp2.exe	106
PID 1680 wrote to memory of 3032	1680	unregmp2.exe	106
PID 4760 wrote to memory of 2972	4760	helppane.exe	125
PID 4760 wrote to memory of 2972	4760	helppane.exe	125
PID 2972 wrote to memory of 2932	2972	msedge.exe	126
PID 2972 wrote to memory of 2932	2972	msedge.exe	126
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 748	2972	msedge.exe	127
PID 2972 wrote to memory of 1716	2972	msedge.exe	128
PID 2972 wrote to memory of 1716	2972	msedge.exe	128
PID 2972 wrote to memory of 1152	2972	msedge.exe	129
PID 2972 wrote to memory of 1152	2972	msedge.exe	129
PID 2972 wrote to memory of 1152	2972	msedge.exe	129
PID 2972 wrote to memory of 1152	2972	msedge.exe	129
PID 2972 wrote to memory of 1152	2972	msedge.exe	129
PID 2972 wrote to memory of 1152	2972	msedge.exe	129
PID 2972 wrote to memory of 1152	2972	msedge.exe	129

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Users\Admin\AppData\Local\Temp\tempfile
  "C:\Users\Admin\AppData\Local\Temp\tempfile"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:5052

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\AppData\Roaming\XenoManager\tempfile"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
      4⤵
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      PID:3032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 2276
    3⤵
    - Program crash
    PID:2056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3048 -ip 3048
1⤵
PID:1844

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:1924

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528884
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa28f446f8,0x7ffa28f44708,0x7ffa28f44718
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,14722288446606007992,3962037326723971712,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,14722288446606007992,3962037326723971712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,14722288446606007992,3962037326723971712,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
    3⤵
    PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14722288446606007992,3962037326723971712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14722288446606007992,3962037326723971712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14722288446606007992,3962037326723971712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14722288446606007992,3962037326723971712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
    3⤵
    PID:3752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4724

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Drops file in System32 directory
PID:1916
- C:\Windows\system32\tempfile
  "C:\Windows\system32\tempfile"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1576

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\test.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\test.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4072
- C:\Windows\system32\tempfile
  "C:\Windows\system32\tempfile"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\test.exe.log

Filesize
425B

MD5
fff5cbccb6b31b40f834b8f4778a779a

SHA1
899ed0377e89f1ed434cfeecc5bc0163ebdf0454

SHA256
b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76

SHA512
1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
619241d3d38edcc74fa98998ed2f731c

SHA1
61ade05a5cd3490ad089c760a163e3b8225ef05b

SHA256
b0393ccdc5ce0bd6ea4505022edccdb85dc670491a714324612a7d8b474911c8

SHA512
7a537063f6e40dddf046a2a1611c4e1ca23edcbe8b326e323561d42eeb6403845bf26d3bb4e06c3d389920818c104db3583e60bab2a6db1bb38805db9793f7d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
248B

MD5
aa5c9ef101e0cca61678dcaed524270e

SHA1
94f9882349038ee458e04301b6ec123b0952860f

SHA256
cf77a8227d134ac5fec1aff2b71ab2d8ff3f89b588639ee06904b6578eabf404

SHA512
81717f814dbccb17f1dab5c07b48c63a43ab326bd764e7ffef704567a99356bdf66bc47e3a06b3cf9ae9c0d09e872d5d7415fff1282d7ef759278832a8fdfe1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b636d147-9ea2-4c83-8926-158ac1a1ec1e.tmp

Filesize
5KB

MD5
fa445e59e47ce3cdd39e1cbbf8016fe1

SHA1
72783586a8bb6e2c008ae9056cce4e00664bdde4

SHA256
11f5d9d5241817af55c0e06e0e4230d5e7aff424c372c915ef90300e119fdc74

SHA512
6e1bec0cfe822def3df2dea8399ea31bd555a02e651b577a5bac9310e02c868a68922fc6016f9b94b80a5208887896cfa82c8c87f59faa116d7a280b4551cb01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b9316516-66d7-4546-b52c-9d84e63b6f8f.tmp

Filesize
6KB

MD5
8f906c4c1527d9b5758c124ead725506

SHA1
ccc2a5e6974e4ec551eb55347f453e41f6c677b1

SHA256
284d656e451d9fc223e787cc2380bfb1bd93757b2b0f33f473c3dc70230fd2c1

SHA512
4bad2177a514400f77e65978e36413795e13fa387a6dc753fb25da4c4ffbde96396c2c60277ce8497ca337ebb99315902d15d4257211442716847eab145b2b41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3ea8a822e5761508dd38f239880a6691

SHA1
54493c719c962929f5dc44e2875315e7d381582e

SHA256
f44b592aed673af542a6fa555d041f6781815562979261593408d5ff60b942ec

SHA512
5c88b439d0346192300b6a109d9803e79e2f6365f5a63d6c6e298a92ad3f4288901b6a4cfc6947b132231d6d7ccaa8844608de46d621474366c1524f6e40b528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
adbd8353954edbe5e0620c5bdcad4363

SHA1
aeb5c03e8c1b8bc5d55683ea113e6ce1be7ac6e6

SHA256
64eff10c4e866930d32d4d82cc88ec0e6f851ac49164122cae1b27eb3c9d9d55

SHA512
87bf4a2dc4dd5c833d96f3f5cb0b607796414ffee36d5c167a75644bcbb02ab5159aa4aa093ed43abe290481abc01944885c68b1755d9b2c4c583fcccd041fd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
3795fa9630e600659db96015f4f17fb6

SHA1
271a79a7095e68b7dea3d2af9c80b64280b05d32

SHA256
02fed909a3cfd74ea4edc33c75ce43ca60be4c40184abd1068ccfeb5825a0a66

SHA512
966da729e4faf8527d10d978e318dab889b24f8843c7f1f497ef411142ee1442f3cdab82a988a8499416a4c12ccced60cbb528b9afc701913acbea9a2cc6381f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
5433eab10c6b5c6d55b7cbd302426a39

SHA1
c5b1604b3350dab290d081eecd5389a895c58de5

SHA256
23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131

SHA512
207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tempfile

Filesize
45KB

MD5
2be6e608f41c752b6d4d00ee65d3a4dd

SHA1
19d4f38a8c86f29b1fdd43dfbd98c3ad3192ceff

SHA256
481de496a0d953c431a161f7929cabb72817c48d287951e85b76fb1e50529a60

SHA512
b725d3f02658b2033f75e7dc364118c865ce6a48b07acba80e4be54083f09dad6d42d68fd186010b21ce92c3118f9150787d40900b5443f990c6caf6a1d9bd8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
a0e6d184e2d5a67741b0db3f24d9cfed

SHA1
219d8516cec380f038f81f85cabfefebbcfcb64d

SHA256
4ebde23ad4df6dc58f4935c6ba93cddac7db097280e89d932f574230c61a522c

SHA512
dad68b7307b919f353c9843b91f913495c2709e0a7a8f37b648da96aeb76622018eba8cfaeaaf6118f17c6b3d9524b2cb9a96d8d863158b4062c0a5b428779fe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\test.exe

Filesize
163KB

MD5
4531671a39dfdd4a9711e64400f7f0fa

SHA1
55357cd9c957105f9b5af04f1a8e65101229ae4a

SHA256
76c45fabe4e4438e1d9d434e9cd104219fc7e855b90bafaf52b70c069a495b65

SHA512
d35d54d6986dfbe22fcac76792853cacdc1c4b0eecba5cd7703c3b1f50005d42b8e36ccc6a8c5a4928d2c49413896e11779f4e23357b7229b0863511f5ab3f52

Download Submit
memory/1588-1-0x00000000004D0000-0x0000000000500000-memory.dmp

Filesize
192KB

Download
memory/1588-7-0x00007FFA28460000-0x00007FFA28F21000-memory.dmp

Filesize
10.8MB

Download
memory/1588-14-0x00007FFA28460000-0x00007FFA28F21000-memory.dmp

Filesize
10.8MB

Download
memory/1588-0-0x00007FFA28463000-0x00007FFA28465000-memory.dmp

Filesize
8KB

Download
memory/3048-54-0x00000000099C0000-0x00000000099D0000-memory.dmp

Filesize
64KB

Download
memory/3048-58-0x00000000099C0000-0x00000000099D0000-memory.dmp

Filesize
64KB

Download
memory/3048-57-0x00000000099C0000-0x00000000099D0000-memory.dmp

Filesize
64KB

Download
memory/3048-52-0x00000000099C0000-0x00000000099D0000-memory.dmp

Filesize
64KB

Download
memory/3048-50-0x00000000077E0000-0x00000000077F0000-memory.dmp

Filesize
64KB

Download
memory/3048-53-0x00000000099C0000-0x00000000099D0000-memory.dmp

Filesize
64KB

Download
memory/3048-55-0x00000000099C0000-0x00000000099D0000-memory.dmp

Filesize
64KB

Download
memory/3048-56-0x00000000099C0000-0x00000000099D0000-memory.dmp

Filesize
64KB

Download
memory/3048-51-0x00000000099C0000-0x00000000099D0000-memory.dmp

Filesize
64KB

Download
memory/5052-9-0x0000000000A80000-0x0000000000A92000-memory.dmp

Filesize
72KB

Download
memory/5052-8-0x0000000074F9E000-0x0000000074F9F000-memory.dmp

Filesize
4KB

Download