remcos | 7eec8c69d64ff13204172df9055198cba8a2ccd1e1881493de9fc0dafbbca568

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EIuz8Bk9kGav2ix.exe
Size

1002KB
MD5

2e69c1a7d2a987f925aaad945c2ce2b2
SHA1

767d326371a5e8b3e3c85d5a87d3e928364b0e20
SHA256

123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c
SHA512

77bcff731628c92d6a1888db1e05d6bc531607f0fb06f6c735ac8d46a9993bac03ba32461fc461dedcf4e7a3c786a300d981ab0362e92db2cb55453dd65405a6
SSDEEP

24576:50IeeyMLvMqxTE1am3NbYPu5xQBhlbeaI:WBek2TAam9SuxQBhT

Score

10^/10

remcos remotehost discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

192.3.64.152:2559

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-ZFXG9Y
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
3968	powershell.exe
3860	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EIuz8Bk9kGav2ix.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	EIuz8Bk9kGav2ix.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

EIuz8Bk9kGav2ix.exeEIuz8Bk9kGav2ix.exe

description	pid	Process	procid_target
PID 684 set thread context of 5096	684	EIuz8Bk9kGav2ix.exe	95
PID 5096 set thread context of 1584	5096	EIuz8Bk9kGav2ix.exe	96

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

EIuz8Bk9kGav2ix.exepowershell.exepowershell.exeschtasks.exeEIuz8Bk9kGav2ix.exeiexplore.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EIuz8Bk9kGav2ix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EIuz8Bk9kGav2ix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
4400	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

EIuz8Bk9kGav2ix.exepowershell.exepowershell.exeEIuz8Bk9kGav2ix.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
684	EIuz8Bk9kGav2ix.exe
684	EIuz8Bk9kGav2ix.exe
3968	powershell.exe
3860	powershell.exe
684	EIuz8Bk9kGav2ix.exe
5096	EIuz8Bk9kGav2ix.exe
5096	EIuz8Bk9kGav2ix.exe
3860	powershell.exe
3968	powershell.exe
1344	msedge.exe
1344	msedge.exe
636	msedge.exe
636	msedge.exe
4440	identity_helper.exe
4440	identity_helper.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

EIuz8Bk9kGav2ix.exe

pid	Process
5096	EIuz8Bk9kGav2ix.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

EIuz8Bk9kGav2ix.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	684	EIuz8Bk9kGav2ix.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

EIuz8Bk9kGav2ix.exeEIuz8Bk9kGav2ix.exeiexplore.exemsedge.exe

description	pid	Process	procid_target
PID 684 wrote to memory of 3860	684	EIuz8Bk9kGav2ix.exe	89
PID 684 wrote to memory of 3860	684	EIuz8Bk9kGav2ix.exe	89
PID 684 wrote to memory of 3860	684	EIuz8Bk9kGav2ix.exe	89
PID 684 wrote to memory of 3968	684	EIuz8Bk9kGav2ix.exe	91
PID 684 wrote to memory of 3968	684	EIuz8Bk9kGav2ix.exe	91
PID 684 wrote to memory of 3968	684	EIuz8Bk9kGav2ix.exe	91
PID 684 wrote to memory of 4400	684	EIuz8Bk9kGav2ix.exe	93
PID 684 wrote to memory of 4400	684	EIuz8Bk9kGav2ix.exe	93
PID 684 wrote to memory of 4400	684	EIuz8Bk9kGav2ix.exe	93
PID 684 wrote to memory of 5096	684	EIuz8Bk9kGav2ix.exe	95
PID 684 wrote to memory of 5096	684	EIuz8Bk9kGav2ix.exe	95
PID 684 wrote to memory of 5096	684	EIuz8Bk9kGav2ix.exe	95
PID 684 wrote to memory of 5096	684	EIuz8Bk9kGav2ix.exe	95
PID 684 wrote to memory of 5096	684	EIuz8Bk9kGav2ix.exe	95
PID 684 wrote to memory of 5096	684	EIuz8Bk9kGav2ix.exe	95
PID 684 wrote to memory of 5096	684	EIuz8Bk9kGav2ix.exe	95
PID 684 wrote to memory of 5096	684	EIuz8Bk9kGav2ix.exe	95
PID 684 wrote to memory of 5096	684	EIuz8Bk9kGav2ix.exe	95
PID 684 wrote to memory of 5096	684	EIuz8Bk9kGav2ix.exe	95
PID 684 wrote to memory of 5096	684	EIuz8Bk9kGav2ix.exe	95
PID 684 wrote to memory of 5096	684	EIuz8Bk9kGav2ix.exe	95
PID 5096 wrote to memory of 1584	5096	EIuz8Bk9kGav2ix.exe	96
PID 5096 wrote to memory of 1584	5096	EIuz8Bk9kGav2ix.exe	96
PID 5096 wrote to memory of 1584	5096	EIuz8Bk9kGav2ix.exe	96
PID 5096 wrote to memory of 1584	5096	EIuz8Bk9kGav2ix.exe	96
PID 1584 wrote to memory of 636	1584	iexplore.exe	97
PID 1584 wrote to memory of 636	1584	iexplore.exe	97
PID 636 wrote to memory of 5004	636	msedge.exe	98
PID 636 wrote to memory of 5004	636	msedge.exe	98
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99
PID 636 wrote to memory of 4048	636	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\EIuz8Bk9kGav2ix.exe
"C:\Users\Admin\AppData\Local\Temp\EIuz8Bk9kGav2ix.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:684
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\EIuz8Bk9kGav2ix.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3860
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RNJBFdvJTXAE.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3968
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RNJBFdvJTXAE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC469.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4400
- C:\Users\Admin\AppData\Local\Temp\EIuz8Bk9kGav2ix.exe
  "C:\Users\Admin\AppData\Local\Temp\EIuz8Bk9kGav2ix.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:5096
- - \??\c:\program files (x86)\internet explorer\iexplore.exe
    "c:\program files (x86)\internet explorer\iexplore.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa496f46f8,0x7ffa496f4708,0x7ffa496f4718
        5⤵
        
        PID:5004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,10646289929279296802,17501416820519895398,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
        5⤵
        
        PID:4048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1784,10646289929279296802,17501416820519895398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1784,10646289929279296802,17501416820519895398,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3008 /prefetch:8
        5⤵
        
        PID:3324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,10646289929279296802,17501416820519895398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
        5⤵
        
        PID:1244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,10646289929279296802,17501416820519895398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
        5⤵
        
        PID:2228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,10646289929279296802,17501416820519895398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
        5⤵
        
        PID:536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1784,10646289929279296802,17501416820519895398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
        5⤵
        
        PID:2148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1784,10646289929279296802,17501416820519895398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,10646289929279296802,17501416820519895398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
        5⤵
        
        PID:1576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,10646289929279296802,17501416820519895398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
        5⤵
        
        PID:1884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,10646289929279296802,17501416820519895398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
        5⤵
        
        PID:4064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,10646289929279296802,17501416820519895398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
        5⤵
        
        PID:3920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,10646289929279296802,17501416820519895398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
        5⤵
        
        PID:1132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,10646289929279296802,17501416820519895398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
        5⤵
        
        PID:2732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,10646289929279296802,17501416820519895398,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2904 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
      4⤵
      PID:1172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa496f46f8,0x7ffa496f4708,0x7ffa496f4718
        5⤵
        
        PID:4024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
a120d0287665f3a01db12118b7549e8d

SHA1
5d865967d77cc22070ee4c11db0d1a141efbaaae

SHA256
d202638cc44aa55ff8e77ef2b6da927c568f2c9c5b24f5a17deb7068ca66adf3

SHA512
7d3316fa3d4ed10a100ab1895abaf27eb518cb7b80fa5d4f57f7279d7338db6c8d28b52c53f67062823aa36c1ffd3f3ee6790faa1349790f9112e964122849ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c1437d1f9dad5359286f7ed6d9572e32

SHA1
26094050c135867a02e68210c6f7ae64d60149c1

SHA256
ca4c9e26a8e7143d01ed2ce07c733a1f0a6127ce9e0862532aeac62c22d05a6e

SHA512
291420c4b4fe7a95bd7708ef14a9490d8fc0efe25c013480c72c21b89bf677b8090f23072d7897dca1e76567f84b57619c3e890cab04ea78912c94d229de0012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dbbc2de40fc37171e2398bb08f71a92f

SHA1
1341ca0eda6e5ed1a1517fa8e14c4384d781c275

SHA256
1af1b93c3facd9b3efad3c2a0c16dc2915b1fa1d9168f51c7a506b5345d0c8ef

SHA512
22324a7c345412b8467e4bf675b3322edb26aee5d7d1e28e79504a813cded159defe8e7077e8be03405633280035a6e5018a4a284eca6733a556b8064cafa22e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
e42919da9d34c51fee8ba4df3c944293

SHA1
17b6996f3f6c89bc8bdd0d493d74b34fdb9ec93b

SHA256
8a9cdc12135201dde0f1bedc4cc993f50914d4766b6b101000de7311fc5c6e84

SHA512
3364f7e9340d9f6330f91ef51c9140ace6483778bd1be6e548de497626fccd9cb6dd8b57ffc7071352ecfc98dc9af53a5046c9816915fb66184b4ef21ed315e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58368c.TMP

Filesize
371B

MD5
73b9d001119a7acfd3e009479e1f8bfd

SHA1
6afa585ab54e625a7ed697ddb201f07ffd6db8d1

SHA256
5a70d6d3b205b236091eac0ec61fd9301419328cad22c965097a7b16b4df68e0

SHA512
ad75827581ea5126b2ec622068f30bbcdc298abcff5098e609504e1e5b432bac0e7923952912dd32de896c94f2c6abf1689f6bd978e02ab3673976313f2da17d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c00fe987-e3aa-40f0-bbe7-d070396e8022.tmp

Filesize
10KB

MD5
11496454c7035828772ccfec77640134

SHA1
4c32d43eea5d8c13c9be92e8186a4f20f55398a1

SHA256
a9330b7065e730167b2c8e46ed5b57d8f41a33c7f05d333479580c1a21375572

SHA512
88c8c43b5fd991d9aa211d647b6dfe3f9f264cc196743aae8902157db375fdcea7e8717991a99ffa391cb790410fe394750fca3ab84cb387d11e915e2133709f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
7e727be264ff24850db5061916d13dde

SHA1
e86d64787f758f89cb9e441b593388d5c615ea0b

SHA256
a232f70602bdbdf9353b3bb3a20d08c453db92152f788e41ceeb7a1f440baf17

SHA512
c4e61d15d5078c172de3a5b53b00ec8b841869b15d1dbec70a404b6154e321b8aed88877099c7fd32fce2c72ae4509ab7057b42052b8c8f50e5d33eec11cf17b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z5amchfv.mfy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC469.tmp

Filesize
1KB

MD5
b2d2a2e8a087eb1ee1ba300a5c937ca1

SHA1
1ef00d30461057380f3176615e4004c923a46261

SHA256
7e78bac42c4bc8c0504aaf03bb6fce12e37c49382c06ebaf2f5e9c51fd4d4fe3

SHA512
6d8f6144c14ec706d4dac7309fae4414385a4f441e3470d970fc04bae81d2768507954c722931399202fa8c5add5f913a557aafb967a43e3867ab110637905fe

Download Submit
\??\pipe\LOCAL\crashpad_636_SVITMFYHFKBNDDCN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/684-2-0x00000000077E0000-0x0000000007D84000-memory.dmp

Filesize
5.6MB

Download
memory/684-9-0x0000000008AC0000-0x0000000008B84000-memory.dmp

Filesize
784KB

Download
memory/684-8-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/684-7-0x0000000074CCE000-0x0000000074CCF000-memory.dmp

Filesize
4KB

Download
memory/684-6-0x0000000007590000-0x00000000075A8000-memory.dmp

Filesize
96KB

Download
memory/684-5-0x0000000002730000-0x000000000273A000-memory.dmp

Filesize
40KB

Download
memory/684-4-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/684-3-0x0000000007230000-0x00000000072C2000-memory.dmp

Filesize
584KB

Download
memory/684-10-0x000000000C0B0000-0x000000000C14C000-memory.dmp

Filesize
624KB

Download
memory/684-1-0x00000000003A0000-0x00000000004A0000-memory.dmp

Filesize
1024KB

Download
memory/684-0-0x0000000074CCE000-0x0000000074CCF000-memory.dmp

Filesize
4KB

Download
memory/684-50-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/1584-49-0x00000000013A0000-0x00000000014A0000-memory.dmp

Filesize
1024KB

Download
memory/3860-52-0x00000000061B0000-0x00000000061FC000-memory.dmp

Filesize
304KB

Download
memory/3860-25-0x0000000005670000-0x00000000059C4000-memory.dmp

Filesize
3.3MB

Download
memory/3860-15-0x00000000023A0000-0x00000000023D6000-memory.dmp

Filesize
216KB

Download
memory/3860-54-0x0000000071380000-0x00000000713CC000-memory.dmp

Filesize
304KB

Download
memory/3860-53-0x0000000006C90000-0x0000000006CC2000-memory.dmp

Filesize
200KB

Download
memory/3860-64-0x0000000006270000-0x000000000628E000-memory.dmp

Filesize
120KB

Download
memory/3860-65-0x0000000006CD0000-0x0000000006D73000-memory.dmp

Filesize
652KB

Download
memory/3860-16-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/3860-76-0x0000000007620000-0x0000000007C9A000-memory.dmp

Filesize
6.5MB

Download
memory/3860-77-0x0000000006FD0000-0x0000000006FEA000-memory.dmp

Filesize
104KB

Download
memory/3860-78-0x0000000007050000-0x000000000705A000-memory.dmp

Filesize
40KB

Download
memory/3860-79-0x0000000007250000-0x00000000072E6000-memory.dmp

Filesize
600KB

Download
memory/3860-18-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/3860-17-0x0000000004F00000-0x0000000005528000-memory.dmp

Filesize
6.2MB

Download
memory/3860-51-0x0000000005CB0000-0x0000000005CCE000-memory.dmp

Filesize
120KB

Download
memory/3860-90-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/3860-84-0x00000000072F0000-0x00000000072F8000-memory.dmp

Filesize
32KB

Download
memory/3860-45-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/3968-21-0x0000000004B30000-0x0000000004B96000-memory.dmp

Filesize
408KB

Download
memory/3968-91-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/3968-66-0x0000000071380000-0x00000000713CC000-memory.dmp

Filesize
304KB

Download
memory/3968-24-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/3968-82-0x00000000070A0000-0x00000000070B4000-memory.dmp

Filesize
80KB

Download
memory/3968-26-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/3968-83-0x00000000071A0000-0x00000000071BA000-memory.dmp

Filesize
104KB

Download
memory/3968-23-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/3968-81-0x0000000007090000-0x000000000709E000-memory.dmp

Filesize
56KB

Download
memory/3968-20-0x0000000004A90000-0x0000000004AB2000-memory.dmp

Filesize
136KB

Download
memory/3968-22-0x0000000004BA0000-0x0000000004C06000-memory.dmp

Filesize
408KB

Download
memory/3968-80-0x0000000007060000-0x0000000007071000-memory.dmp

Filesize
68KB

Download
memory/5096-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5096-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download