xenorat | 51da22344eb88f90613c1260e0767883504220eb087af4051296724170ad0271

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51da22344eb88f90613c1260e0767883504220eb087af4051296724170ad0271.exe
Size

4.5MB
MD5

faeb91bf5a7103468d164959ba3f0974
SHA1

8edb3aa7c02a6d6ef72034906d9ed233ad8de0eb
SHA256

51da22344eb88f90613c1260e0767883504220eb087af4051296724170ad0271
SHA512

09ca0174ab748ae2fd4fbae87ef3bf3d284112b365687abff91da6e3e03a4418e780fefa576ee5df058f50426c9fd3a8a09a6bc5110f2f0b877e8d5b65c8cbbe
SSDEEP

98304:9wNq3cmCLbLxPplbkajaf5I7tcZVu+Fajxkl9L9jmvXBl80VQNrT1e7asbJ:sTLxhlbka+O7tc3FsjxcJSvAYID0J

Score

10^/10

xenorat discovery evasion rat themida trojan

Malware Config

Extracted

Family

xenorat

96.126.118.61

Mutex

Microsoft Windows_3371808

Attributes

delay
5000
install_path
appdata
port
5037
startup_name
svchost.exe

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Xenorat family
xenorat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	51da22344eb88f90613c1260e0767883504220eb087af4051296724170ad0271.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	51da22344eb88f90613c1260e0767883504220eb087af4051296724170ad0271.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	51da22344eb88f90613c1260e0767883504220eb087af4051296724170ad0271.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/3440-105-0x0000000000C40000-0x0000000001740000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	51da22344eb88f90613c1260e0767883504220eb087af4051296724170ad0271.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3440	51da22344eb88f90613c1260e0767883504220eb087af4051296724170ad0271.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51da22344eb88f90613c1260e0767883504220eb087af4051296724170ad0271.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
768	identity_helper.exe
768	identity_helper.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 1864	3440	51da22344eb88f90613c1260e0767883504220eb087af4051296724170ad0271.exe	86
PID 3440 wrote to memory of 1864	3440	51da22344eb88f90613c1260e0767883504220eb087af4051296724170ad0271.exe	86
PID 1864 wrote to memory of 5036	1864	msedge.exe	87
PID 1864 wrote to memory of 5036	1864	msedge.exe	87
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4552	1864	msedge.exe	88
PID 1864 wrote to memory of 4872	1864	msedge.exe	89
PID 1864 wrote to memory of 4872	1864	msedge.exe	89
PID 1864 wrote to memory of 2012	1864	msedge.exe	90
PID 1864 wrote to memory of 2012	1864	msedge.exe	90
PID 1864 wrote to memory of 2012	1864	msedge.exe	90
PID 1864 wrote to memory of 2012	1864	msedge.exe	90
PID 1864 wrote to memory of 2012	1864	msedge.exe	90
PID 1864 wrote to memory of 2012	1864	msedge.exe	90
PID 1864 wrote to memory of 2012	1864	msedge.exe	90
PID 1864 wrote to memory of 2012	1864	msedge.exe	90
PID 1864 wrote to memory of 2012	1864	msedge.exe	90
PID 1864 wrote to memory of 2012	1864	msedge.exe	90
PID 1864 wrote to memory of 2012	1864	msedge.exe	90
PID 1864 wrote to memory of 2012	1864	msedge.exe	90
PID 1864 wrote to memory of 2012	1864	msedge.exe	90
PID 1864 wrote to memory of 2012	1864	msedge.exe	90
PID 1864 wrote to memory of 2012	1864	msedge.exe	90
PID 1864 wrote to memory of 2012	1864	msedge.exe	90
PID 1864 wrote to memory of 2012	1864	msedge.exe	90
PID 1864 wrote to memory of 2012	1864	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\51da22344eb88f90613c1260e0767883504220eb087af4051296724170ad0271.exe
"C:\Users\Admin\AppData\Local\Temp\51da22344eb88f90613c1260e0767883504220eb087af4051296724170ad0271.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=51da22344eb88f90613c1260e0767883504220eb087af4051296724170ad0271.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9393646f8,0x7ff939364708,0x7ff939364718
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7794527600967346290,2182238376260487287,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,7794527600967346290,2182238376260487287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,7794527600967346290,2182238376260487287,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7794527600967346290,2182238376260487287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7794527600967346290,2182238376260487287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7794527600967346290,2182238376260487287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7794527600967346290,2182238376260487287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7794527600967346290,2182238376260487287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7794527600967346290,2182238376260487287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7794527600967346290,2182238376260487287,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
    3⤵
    PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7794527600967346290,2182238376260487287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7794527600967346290,2182238376260487287,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7794527600967346290,2182238376260487287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7794527600967346290,2182238376260487287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7794527600967346290,2182238376260487287,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4764 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=51da22344eb88f90613c1260e0767883504220eb087af4051296724170ad0271.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9393646f8,0x7ff939364708,0x7ff939364718
    3⤵
    PID:4724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
c5e51c9cc4c5e9d6345e832df8b10212

SHA1
99728eade59d37a7bd62b4a8a958a8e67b04f8ca

SHA256
58bee70066c4347fcd1bcfe5538cd07f65fbc4053b7b9985a8b9c3c972dc6cd0

SHA512
f4793ceaf805a041f0c370792a3204a3ad373c7c2b4a13f9422692a9c8a2dfff346c959c093ea99dd5d29f2e4b366716e0de91833344cd210ad4e098e4a02525

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
77bfb4b5765678675178cafbc8857d83

SHA1
81c6a6076991ea07c9be7b32d92c63539a8ba04a

SHA256
fd302cbf478b289d20d9520e3747a4b243d195306b401d0e9316a7e3418d22dc

SHA512
8afba0538054d82a289b4bcbc2028fca638bdcf99cd50a832e23c9cc38e5dc0425bec89b8ed42deaf7ecbeb5f2ee5437f124200835f28f608db3dbc3106c671c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2335d08376847f7c3f2d66332343cf31

SHA1
68e2d2a7fba1578b46a50a303554509a157ccee9

SHA256
e7e305c13d4774803e3b3d4e921156a2e8ee30bdcd5699054554d8a467c95bf5

SHA512
1a722e99634effbb14ceb506402a19e8dd572ecb3bf9e93b57a6ca09df149c106e98cab8136cdb8f2e35e8137581fddbd24fac34fc3e3a2a22c3cafb0cbb07e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
655f0c6d3e8f9781689f8d306a1708fe

SHA1
dbebfd056d2ace0336070748788810d38a245e0b

SHA256
39824968068432b9affdfa3d7db24a95fd3114705e4556b06436b6df36e414ba

SHA512
8bf812c7f146ac534efccdc9aac7ce9fd2c976fcc06e4e47e89d827723ecd3ae4cc63e2b16d2f6368af7978ca1d689b6fa447c31eeb2da9206efb2f65c02defd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
8d7f8ebb6c7bcfc863c4195475364853

SHA1
7cc792519bd76cdb51d9b443c311e653ccb81e62

SHA256
f47f54fd4ed4932d9e8b2a47f2aaef8a6be4903ba89ac09f14cac048e94b18e1

SHA512
21286d9bf91b90791835f6b00562e3c137ef416b3965d79de2b9f10c9b6705fb43d3c3eeeed75dc29723d4aa367829c2b90e81b274d3c453aa8a79d847d92d07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581a59.TMP

Filesize
371B

MD5
57700224180735ab4dc2964eeee7a2cd

SHA1
9a575f742a323715350c81a3bb1eda4e25b8e7d1

SHA256
97b03f7ee15443ffd753c1549786b1fa0fecae6f6146ec503446f0c2e70801a9

SHA512
1bdbc0788dcaff4ce8c9aff10cd4acaaa66f79a3f7059531a44c2c77b58ca85281c6a8da6e09cdab8fd897f59ff7dc5e3ad90d84103b9bd481379df343e49f33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fc5188c327646c3401c984c719e3ef06

SHA1
9bcc90c6a655a26be20940885872673b1e891ace

SHA256
86e9082fa27847a9fa6cc4164a187299c821e596b37e16ed11175756aac8d224

SHA512
3fee78a41de39912b8f5f9f3c195eec6403fe1e927e3c7feb5c50295f476d00d2a94e0b2f7162d731c5047683718611afcc493e47060f1dcfe75a6d1a3a9550c

Download Submit
memory/3440-7-0x0000000075CD0000-0x0000000075DC0000-memory.dmp

Filesize
960KB

Download
memory/3440-0-0x0000000000C40000-0x0000000001740000-memory.dmp

Filesize
11.0MB

Download
memory/3440-34-0x0000000075CD0000-0x0000000075DC0000-memory.dmp

Filesize
960KB

Download
memory/3440-39-0x0000000075CD0000-0x0000000075DC0000-memory.dmp

Filesize
960KB

Download
memory/3440-63-0x0000000075CD0000-0x0000000075DC0000-memory.dmp

Filesize
960KB

Download
memory/3440-69-0x0000000075CD0000-0x0000000075DC0000-memory.dmp

Filesize
960KB

Download
memory/3440-70-0x0000000075CD0000-0x0000000075DC0000-memory.dmp

Filesize
960KB

Download
memory/3440-10-0x0000000000C40000-0x0000000001740000-memory.dmp

Filesize
11.0MB

Download
memory/3440-81-0x0000000075CD0000-0x0000000075DC0000-memory.dmp

Filesize
960KB

Download
memory/3440-11-0x0000000075CF0000-0x0000000075CF1000-memory.dmp

Filesize
4KB

Download
memory/3440-6-0x0000000075CD0000-0x0000000075DC0000-memory.dmp

Filesize
960KB

Download
memory/3440-105-0x0000000000C40000-0x0000000001740000-memory.dmp

Filesize
11.0MB

Download
memory/3440-106-0x0000000075CD0000-0x0000000075DC0000-memory.dmp

Filesize
960KB

Download
memory/3440-5-0x0000000075CD0000-0x0000000075DC0000-memory.dmp

Filesize
960KB

Download
memory/3440-4-0x0000000075CD0000-0x0000000075DC0000-memory.dmp

Filesize
960KB

Download
memory/3440-3-0x0000000075CD0000-0x0000000075DC0000-memory.dmp

Filesize
960KB

Download
memory/3440-2-0x0000000075CD0000-0x0000000075DC0000-memory.dmp

Filesize
960KB

Download
memory/3440-1-0x0000000075CF0000-0x0000000075CF1000-memory.dmp

Filesize
4KB

Download