remcos | 123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2024 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe
Size

1002KB
MD5

2e69c1a7d2a987f925aaad945c2ce2b2
SHA1

767d326371a5e8b3e3c85d5a87d3e928364b0e20
SHA256

123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c
SHA512

77bcff731628c92d6a1888db1e05d6bc531607f0fb06f6c735ac8d46a9993bac03ba32461fc461dedcf4e7a3c786a300d981ab0362e92db2cb55453dd65405a6
SSDEEP

24576:50IeeyMLvMqxTE1am3NbYPu5xQBhlbeaI:WBek2TAam9SuxQBhT

Score

10^/10

remcos remotehost discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

192.3.64.152:2559

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-ZFXG9Y
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
1900	powershell.exe
4788	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe

description	pid	Process	procid_target
PID 4820 set thread context of 1096	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	102
PID 1096 set thread context of 4216	1096	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	103

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exeschtasks.exe123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exeiexplore.exe123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exepowershell.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
5028	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exepowershell.exepowershell.exe123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe
4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe
1900	powershell.exe
4788	powershell.exe
4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe
1096	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe
1096	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe
1900	powershell.exe
4788	powershell.exe
1404	msedge.exe
1404	msedge.exe
3928	msedge.exe
3928	msedge.exe
2308	identity_helper.exe
2308	identity_helper.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe

pid	Process
1096	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid	Process
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exeiexplore.exemsedge.exe

description	pid	Process	procid_target
PID 4820 wrote to memory of 1900	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	96
PID 4820 wrote to memory of 1900	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	96
PID 4820 wrote to memory of 1900	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	96
PID 4820 wrote to memory of 4788	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	98
PID 4820 wrote to memory of 4788	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	98
PID 4820 wrote to memory of 4788	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	98
PID 4820 wrote to memory of 5028	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	100
PID 4820 wrote to memory of 5028	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	100
PID 4820 wrote to memory of 5028	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	100
PID 4820 wrote to memory of 1096	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	102
PID 4820 wrote to memory of 1096	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	102
PID 4820 wrote to memory of 1096	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	102
PID 4820 wrote to memory of 1096	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	102
PID 4820 wrote to memory of 1096	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	102
PID 4820 wrote to memory of 1096	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	102
PID 4820 wrote to memory of 1096	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	102
PID 4820 wrote to memory of 1096	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	102
PID 4820 wrote to memory of 1096	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	102
PID 4820 wrote to memory of 1096	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	102
PID 4820 wrote to memory of 1096	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	102
PID 4820 wrote to memory of 1096	4820	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	102
PID 1096 wrote to memory of 4216	1096	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	103
PID 1096 wrote to memory of 4216	1096	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	103
PID 1096 wrote to memory of 4216	1096	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	103
PID 1096 wrote to memory of 4216	1096	123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe	103
PID 4216 wrote to memory of 3928	4216	iexplore.exe	104
PID 4216 wrote to memory of 3928	4216	iexplore.exe	104
PID 3928 wrote to memory of 1536	3928	msedge.exe	105
PID 3928 wrote to memory of 1536	3928	msedge.exe	105
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106
PID 3928 wrote to memory of 2660	3928	msedge.exe	106

C:\Users\Admin\AppData\Local\Temp\123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe
"C:\Users\Admin\AppData\Local\Temp\123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1900
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RNJBFdvJTXAE.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RNJBFdvJTXAE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDC08.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5028
- C:\Users\Admin\AppData\Local\Temp\123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe
  "C:\Users\Admin\AppData\Local\Temp\123d60e73ef07b75f285d67de12c69137304e6932415b20d76432914f3e15e1c.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1096
- - \??\c:\program files (x86)\internet explorer\iexplore.exe
    "c:\program files (x86)\internet explorer\iexplore.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd555046f8,0x7ffd55504708,0x7ffd55504718
        5⤵
        
        PID:1536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,10964474709782083604,1495373050522260541,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
        5⤵
        
        PID:2660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,10964474709782083604,1495373050522260541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,10964474709782083604,1495373050522260541,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
        5⤵
        
        PID:3188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10964474709782083604,1495373050522260541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
        5⤵
        
        PID:2620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10964474709782083604,1495373050522260541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
        5⤵
        
        PID:3652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10964474709782083604,1495373050522260541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
        5⤵
        
        PID:4100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,10964474709782083604,1495373050522260541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
        5⤵
        
        PID:2272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,10964474709782083604,1495373050522260541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10964474709782083604,1495373050522260541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
        5⤵
        
        PID:4708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10964474709782083604,1495373050522260541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
        5⤵
        
        PID:3596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10964474709782083604,1495373050522260541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
        5⤵
        
        PID:228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10964474709782083604,1495373050522260541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
        5⤵
        
        PID:2312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10964474709782083604,1495373050522260541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
        5⤵
        
        PID:2872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10964474709782083604,1495373050522260541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
        5⤵
        
        PID:5028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,10964474709782083604,1495373050522260541,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3120 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
      4⤵
      PID:4428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd555046f8,0x7ffd55504708,0x7ffd55504718
        5⤵
        
        PID:3628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
54870742fd8cd9861618afa90fcdb8b9

SHA1
95c8e2f5f4db3c165727419dbe0c5a009045242d

SHA256
b981388255a702787c3f01834f6190939071fbf14da9947dab6b9fc8600acf55

SHA512
9765836869a00d1e8eb6507da46b3b047f59aac3f0edfecba744c065379295b358271c6385cc5700e61595e7d3b20f3db8da212955c8c0f1b7f3d361593da270

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8d8b218df024990604bd540d6d6acee7

SHA1
429c6a9ecb0f94dc48d69e1e1676cf5863e33498

SHA256
f8111012b27bfad1b0825c87b4c42283ff4e74a32de329085be921afb3f98437

SHA512
3c347ad3b6a983aada83ed454b66c495d25476950b065289a2ffe4f8c6193dbf3fd875d80d91000d9923896ab1bd6d1aaa62b372a2cd7bee8a950f4d5db6f30a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fded437c443131ad1c3fbc28807274ba

SHA1
cf8f2496d4a4b64aeabec6c96056819835a5055f

SHA256
66e6282169977ae90d617dc6d550c5654c9db32978ef1d5a99ffee8864c54e0a

SHA512
fae78dfc8f84c53213ce8302a480738ced6ca7c9254a13cae53cbb274bf88c5d58b7483524341ff6c652839ede141b279db7fc4dfaa67b9d8c2f914fe1fa692f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
99945721fa55c0359c5827e46aabbb0d

SHA1
025eb0965c223ec1c6cdea1fa57ca9e84b2109a6

SHA256
d7f2ab9ac0ee172898589710c03b993a41b06f613a0a0b28ffe9b151c2141b6d

SHA512
d4a7d8f9cef5b6eb8622c986d97bc8901126a5bc6f36e472c5c3719fe44bc73945239a4e975424119e994d6908349154e11e4be2ff78e79c3783e3aed07e7ccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
8fd92968f2a90dd8ed8c470dec41b92f

SHA1
2b9206fd2979d690cdce3c36f0a98601eb65c329

SHA256
7f8d4230fcdeada634ec8cb2ff3b83e7a52e0aec9d0137b1a7d936299b13e347

SHA512
d56d1064f4eae31b16a0734993eb2715171a726576fab70ff1e3bcdf483510df6fea3c44f6d115f6adef43b12394ec752815b287b633200f61daf9744a5c6ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58487e.TMP

Filesize
371B

MD5
afd76db62b12dcdc3662a0c994a4fffe

SHA1
bc5fece0bc3aa97e1ec0630d448c814877be2ad8

SHA256
566c0b28923a79dd4e9e15c8ab96d61ae278aa9ef08d49692d3f89c4c751e087

SHA512
72205177af0a5648c0b476394cd9b9604e2d844ad5c9aa7392ae144c1b3d48f0e4df50ccb5d5d06bcb27b9e9b7f804803d1913162a70be8cda6965fbe0146635

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
95d9e7c47f1ce515999d350bfa0d4415

SHA1
50bd3a52f61a9b038be158b2089d3ce1473d957a

SHA256
2f4162bc9bc8d5b80f88e636c74efc5a5a0a04de932f01d411f81eb996d45537

SHA512
88b88b4e3f32682f1e376e12fc7e82b0832cbcf50d8eba87d7447f15e3b0d90bcc2a021a00a3adb9aa22d9349966a9a6d10343823caba555cd5cba7d405fc6e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
4a0388593eeb4a14f44f7992267c2e9c

SHA1
6d6ebca11770f56ac02b27ad63b781561a6612d1

SHA256
e58d5207a2285c8b204d735674e631a71daef795bf84921188dbece967fb05ea

SHA512
9d01acdea32abb70c6848b6b25c84478441593b6d877a946698cf4c6454b69982fb30c4fafd14531e58e21b09ee75006914de786d9ee4bfb3797583ba526decb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_achax4nj.uor.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDC08.tmp

Filesize
1KB

MD5
b56b6feda370238082cabbdffaaca36c

SHA1
2ca3942c6b1301d929a7b8bd27d1ecd9e6dc2b62

SHA256
dd10faa9beb055375c270e3ac9778ae35c52919faceee3bfcc6053795887836e

SHA512
672bc5e9d0546ea65d373f8ecff58c4996e50803d816970526e1771a02b173fb0f6883e1a3f3a586520ff0d1e855f10b657b84358259879b824706717a2e52d9

Download Submit
\??\pipe\LOCAL\crashpad_3928_AVYBCJASKCNOVMLJ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1096-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1096-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1900-89-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/1900-15-0x0000000004980000-0x00000000049B6000-memory.dmp

Filesize
216KB

Download
memory/1900-24-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/1900-21-0x0000000004F90000-0x0000000004FF6000-memory.dmp

Filesize
408KB

Download
memory/1900-22-0x0000000005000000-0x0000000005066000-memory.dmp

Filesize
408KB

Download
memory/1900-16-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/1900-20-0x0000000004EF0000-0x0000000004F12000-memory.dmp

Filesize
136KB

Download
memory/1900-17-0x0000000005090000-0x00000000056B8000-memory.dmp

Filesize
6.2MB

Download
memory/1900-82-0x0000000007520000-0x000000000753A000-memory.dmp

Filesize
104KB

Download
memory/1900-81-0x0000000007420000-0x0000000007434000-memory.dmp

Filesize
80KB

Download
memory/1900-50-0x0000000005E90000-0x0000000005EAE000-memory.dmp

Filesize
120KB

Download
memory/1900-51-0x0000000005F40000-0x0000000005F8C000-memory.dmp

Filesize
304KB

Download
memory/1900-52-0x0000000006E50000-0x0000000006E82000-memory.dmp

Filesize
200KB

Download
memory/1900-53-0x00000000734B0000-0x00000000734FC000-memory.dmp

Filesize
304KB

Download
memory/1900-63-0x0000000006480000-0x000000000649E000-memory.dmp

Filesize
120KB

Download
memory/1900-77-0x0000000007250000-0x000000000725A000-memory.dmp

Filesize
40KB

Download
memory/1900-66-0x0000000007090000-0x0000000007133000-memory.dmp

Filesize
652KB

Download
memory/1900-75-0x0000000007820000-0x0000000007E9A000-memory.dmp

Filesize
6.5MB

Download
memory/4216-48-0x0000000000920000-0x0000000000A20000-memory.dmp

Filesize
1024KB

Download
memory/4788-44-0x0000000005F40000-0x0000000006294000-memory.dmp

Filesize
3.3MB

Download
memory/4788-78-0x0000000007A50000-0x0000000007AE6000-memory.dmp

Filesize
600KB

Download
memory/4788-19-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/4788-80-0x0000000007A00000-0x0000000007A0E000-memory.dmp

Filesize
56KB

Download
memory/4788-76-0x00000000077D0000-0x00000000077EA000-memory.dmp

Filesize
104KB

Download
memory/4788-64-0x00000000734B0000-0x00000000734FC000-memory.dmp

Filesize
304KB

Download
memory/4788-83-0x0000000007AF0000-0x0000000007AF8000-memory.dmp

Filesize
32KB

Download
memory/4788-18-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/4788-90-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/4788-42-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/4788-79-0x00000000079D0000-0x00000000079E1000-memory.dmp

Filesize
68KB

Download
memory/4820-1-0x0000000000790000-0x0000000000890000-memory.dmp

Filesize
1024KB

Download
memory/4820-0-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

Filesize
4KB

Download
memory/4820-10-0x000000000C2A0000-0x000000000C33C000-memory.dmp

Filesize
624KB

Download
memory/4820-9-0x0000000008CB0000-0x0000000008D74000-memory.dmp

Filesize
784KB

Download
memory/4820-8-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/4820-7-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

Filesize
4KB

Download
memory/4820-6-0x0000000007AD0000-0x0000000007AE8000-memory.dmp

Filesize
96KB

Download
memory/4820-5-0x0000000002B90000-0x0000000002B9A000-memory.dmp

Filesize
40KB

Download
memory/4820-4-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/4820-3-0x0000000007750000-0x00000000077E2000-memory.dmp

Filesize
584KB

Download
memory/4820-2-0x0000000007C60000-0x0000000008204000-memory.dmp

Filesize
5.6MB

Download
memory/4820-49-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download