redline | 4d0f2f8fd89fec7e4f1348b5b6a0ea528d2b391f48e69df140b91845c0989abe

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2477.exe
Size

125KB
MD5

02201ab0ffca3905fbf110296fd58298
SHA1

4068eb4c09f6e09637588ee3cf62bf7229a25faa
SHA256

4d0f2f8fd89fec7e4f1348b5b6a0ea528d2b391f48e69df140b91845c0989abe
SHA512

4f2d86d8dbdb6946bdd982b7c48aea803eccd99c51ddbd6edcb1f7301f9a8f255953210b5b47ecd6e6a8f1bf93269bb519b3a83548f7d3ea63ded3980bef3705
SSDEEP

1536:Rn7TvjnE1RowM/gZbgjx1LAYivy6sDOsyrXdtyVt3A7HPd4n+lbeRZIbSQPYU:RHovoX/0bgAoORHyHQbPRyZ2pPYU

Score

10^/10

redline stormkitty xworm l3monlogs discovery execution infostealer persistence ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

l3monlogs

78.70.235.238:1912

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/4572-312-0x000000001C800000-0x000000001C80E000-memory.dmp	disable_win_def

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4572-1-0x0000000000A40000-0x0000000000A66000-memory.dmp	family_xworm
behavioral2/files/0x000b000000023c96-59.dat	family_xworm

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0004000000000707-337.dat	family_redline
behavioral2/memory/2268-345-0x0000000000680000-0x00000000006D2000-memory.dmp	family_redline

Redline family
redline
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/4572-373-0x000000001B880000-0x000000001B9A0000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2752	powershell.exe
5004	powershell.exe
4540	powershell.exe
4036	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	2477.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.lnk	2477.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.lnk	2477.exe

Executes dropped EXE 3 IoCs

pid	Process
980	spoolsv.exe
3740	spoolsv.exe
2268	lvfxat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "C:\\Users\\Admin\\AppData\\Roaming\\spoolsv.exe"	2477.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	2477.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lvfxat.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2752	powershell.exe
2752	powershell.exe
5004	powershell.exe
5004	powershell.exe
4540	powershell.exe
4540	powershell.exe
4036	powershell.exe
4036	powershell.exe
4572	2477.exe
4684	msedge.exe
4684	msedge.exe
772	msedge.exe
772	msedge.exe
816	identity_helper.exe
816	identity_helper.exe
4572	2477.exe
4572	2477.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe
2268	lvfxat.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4572	2477.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	4036	powershell.exe
Token: SeDebugPrivilege	4572	2477.exe
Token: SeDebugPrivilege	980	spoolsv.exe
Token: SeDebugPrivilege	3740	spoolsv.exe
Token: SeDebugPrivilege	2268	lvfxat.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4572	2477.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 2752	4572	2477.exe	86
PID 4572 wrote to memory of 2752	4572	2477.exe	86
PID 4572 wrote to memory of 5004	4572	2477.exe	88
PID 4572 wrote to memory of 5004	4572	2477.exe	88
PID 4572 wrote to memory of 4540	4572	2477.exe	90
PID 4572 wrote to memory of 4540	4572	2477.exe	90
PID 4572 wrote to memory of 4036	4572	2477.exe	92
PID 4572 wrote to memory of 4036	4572	2477.exe	92
PID 4572 wrote to memory of 4128	4572	2477.exe	96
PID 4572 wrote to memory of 4128	4572	2477.exe	96
PID 4572 wrote to memory of 772	4572	2477.exe	111
PID 4572 wrote to memory of 772	4572	2477.exe	111
PID 772 wrote to memory of 2340	772	msedge.exe	112
PID 772 wrote to memory of 2340	772	msedge.exe	112
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 2312	772	msedge.exe	113
PID 772 wrote to memory of 4684	772	msedge.exe	114
PID 772 wrote to memory of 4684	772	msedge.exe	114
PID 772 wrote to memory of 4668	772	msedge.exe	115
PID 772 wrote to memory of 4668	772	msedge.exe	115
PID 772 wrote to memory of 4668	772	msedge.exe	115
PID 772 wrote to memory of 4668	772	msedge.exe	115
PID 772 wrote to memory of 4668	772	msedge.exe	115
PID 772 wrote to memory of 4668	772	msedge.exe	115
PID 772 wrote to memory of 4668	772	msedge.exe	115
PID 772 wrote to memory of 4668	772	msedge.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2477.exe
"C:\Users\Admin\AppData\Local\Temp\2477.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2477.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2477.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4036
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "spoolsv" /tr "C:\Users\Admin\AppData\Roaming\spoolsv.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffadc7f46f8,0x7ffadc7f4708,0x7ffadc7f4718
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,12818147825034922518,2322224166460913885,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,12818147825034922518,2322224166460913885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,12818147825034922518,2322224166460913885,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12818147825034922518,2322224166460913885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12818147825034922518,2322224166460913885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,12818147825034922518,2322224166460913885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,12818147825034922518,2322224166460913885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12818147825034922518,2322224166460913885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12818147825034922518,2322224166460913885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12818147825034922518,2322224166460913885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12818147825034922518,2322224166460913885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
    3⤵
    PID:3188
- C:\Users\Admin\AppData\Local\Temp\lvfxat.exe
  "C:\Users\Admin\AppData\Local\Temp\lvfxat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2268

C:\Users\Admin\AppData\Roaming\spoolsv.exe
C:\Users\Admin\AppData\Roaming\spoolsv.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1340

C:\Users\Admin\AppData\Roaming\spoolsv.exe
C:\Users\Admin\AppData\Roaming\spoolsv.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\spoolsv.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
a243e859bccb2076c28919061d5eab6d

SHA1
0204d55043820aef6b20e8f871e38bc6fc1b0282

SHA256
7f8127412404c3ea2fa386cfe2f623bc6a24a6e2081da495130312a6bcdeb2d4

SHA512
e4694d1e00188654989398004584f5ef3db50ba2037293d35978fc7f8f8e4133272402a392dac615e27c22e54bc805217aaf9f522ed3d73d48c5a914049e087f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aac6831f6f7cdd51baf9585273a91648

SHA1
1439ad415a9420019c80c4f553f3fc0a746323b1

SHA256
d63007e21b4c27d88791d90283a7e63ce599240a6af4bb55f10f5994707ca3b6

SHA512
8a9428b87ec6db64300131fa36cd28a7537c85e9b88ef387fe6cd83a4ff726a8e869a34d31146ea8c9cda95ed22b1dfef699a5cd205fe6577be0659b45cc95c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9a0c226925dc6b8a341dbac88bf5bb31

SHA1
dbc33ff3da8dcdecb65bb4afc06d5b79c04000d2

SHA256
c6587e22dc34574f201c4bbe8348e7dfb13e4e8306830e3199af79e9a4036cc9

SHA512
e8dc03a83c6565cb985e190d7593c0f65695d23993e22398c2931437635d27d8b2b0e4d9fd49e30b8c0b56416157332964c56aba34c555d68b224f7737e9ccc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6e4286bc13a405cb7526a975a9bcde3f

SHA1
bf12501a67f185eb341d0bca64fc8b1619ada161

SHA256
1150cc50a2429dc69842786f5ecc478e432ccbd6e8851e302b345bb7491a76b9

SHA512
f7585c6726030b529b1c7c4639e8ad0eca67412b81c4de6b5fde37987a824d7b6ec0043302d101626cfdd8b655445c85bbcb697f27df287265d945482e538619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
62b474136e38cad1683d20f7dfc41876

SHA1
d09a3848c2fb6b2f80f46a28ca0e665e46a9b015

SHA256
0a9abdf4b4529e32b99ddb642b87404dae535def977cb796e7490a930f0c2589

SHA512
ff3d2c70ffc3a9c333cdb257c7287d969a44565c9fcc2917aa81d64decdd5f0db633c8a8a9f6de790f38c6093edd96de8075c3aa172a70c8d983cfaa666614e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
34f595487e6bfd1d11c7de88ee50356a

SHA1
4caad088c15766cc0fa1f42009260e9a02f953bb

SHA256
0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d

SHA512
10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a7cc007980e419d553568a106210549a

SHA1
c03099706b75071f36c3962fcc60a22f197711e0

SHA256
a5735921fc72189c8bf577f3911486cf031708dc8d6bc764fe3e593c0a053165

SHA512
b9aaf29403c467daef80a1ae87478afc33b78f4e1ca16189557011bb83cf9b3e29a0f85c69fa209c45201fb28baca47d31756eee07b79c6312c506e8370f7666

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yqp0ihhq.zoa.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\lvfxat.exe

Filesize
300KB

MD5
dfefdd2e554fd23f3b87f68c3e0f9622

SHA1
8be107d3c7e0aba6346ccdac289e29e3a8127af2

SHA256
f47c2bb84ce619d0d69445b0a1dce760482f2dd508815ba2667bab5c3a3541e9

SHA512
8f11525da059c6aa655d5ad2c41f89ce535ebb7a2bd4d7ce197c2ea244f28947e2338b1f97378130179490e49fd73402ee3dcdc507901f48b41ce9acf79ca182

Download Submit
C:\Users\Admin\AppData\Roaming\spoolsv.exe

Filesize
125KB

MD5
02201ab0ffca3905fbf110296fd58298

SHA1
4068eb4c09f6e09637588ee3cf62bf7229a25faa

SHA256
4d0f2f8fd89fec7e4f1348b5b6a0ea528d2b391f48e69df140b91845c0989abe

SHA512
4f2d86d8dbdb6946bdd982b7c48aea803eccd99c51ddbd6edcb1f7301f9a8f255953210b5b47ecd6e6a8f1bf93269bb519b3a83548f7d3ea63ded3980bef3705

Download Submit
C:\Users\Admin\Desktop\How To Decrypt My Files.html

Filesize
639B

MD5
d2dbbc3383add4cbd9ba8e1e35872552

SHA1
020abbc821b2fe22c4b2a89d413d382e48770b6f

SHA256
5ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be

SHA512
bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66

Download Submit
C:\Users\Admin\Documents\LockSubmit.docx.ENC

Filesize
18KB

MD5
f2c8a2b91d72b15214afddc812419fd0

SHA1
22a22fc9369d5556c74dd676dbdda5bfb625750e

SHA256
9dfa454f444809c73f1960eef60eed7d7b5d4445aec8a9d723ca21353b01cc3d

SHA512
d33394b508951fe6683661892cb67d871ea61aca28c279684f80c7da742f7ee308db86703203eddf83f9aab03b64bcefd195e271745274dab0a3660e536d561b

Download Submit
C:\Users\Admin\Documents\MergeConvertTo.doc.ENC

Filesize
1.0MB

MD5
32d7f29f79b5d7e18a3e041b23755e7f

SHA1
37f9776e101f414fe19d40c09995b350e90129ae

SHA256
bf577730a3e5efcae694d8663cdf4023cfa8032aadf5f76965df428d07006b01

SHA512
d8a480d2cb779e31ae97b6d4de2abc7a189af3fffdc3b1a3edd1f7739f00c7ea26beea45c1e239a2d10c7fd30b6530a74af1dabada8290a15a4b3378fd165e0f

Download Submit
C:\Users\Admin\Documents\NewApprove.docx.ENC

Filesize
13KB

MD5
687e590c34b24228784c4eeb6981d53f

SHA1
7cf19c1bfad84663107d4cc2ebbeb38e5290c77a

SHA256
af4632ab07a0c9b2ef087a75b29e36f315a6ca097115fc2f444b46a6c083e7c7

SHA512
15e3d0a3ff78ef2a89d8dca7f83e03a1a51ba159ce745a1aacbd7377d2b49b09a63aab9922a0ab06d38b7d634af0165bf566ddbfcc1800c34969c7afb36599a7

Download Submit
C:\Users\Admin\Documents\OutExit.docx.ENC

Filesize
18KB

MD5
639bd952ddb6cc5f51e6d390376badad

SHA1
db8eb2fd7512ae37ca5d03633af2a8a9a5ace401

SHA256
e04609c54d3c0af7fb830d8c5ddb3a5d7eedf5b870c14b37bfa5fbb2f5ff7295

SHA512
374859bab564ac13e0b5f47c480dbcf5af0c2120ce41cd490cec2f155876a4d43707bc62f5cbae2790db2a5455035057a4de7c3eb2c240bbcfbef52083158000

Download Submit
C:\Users\Admin\Documents\PingTest.docx.ENC

Filesize
491KB

MD5
c4af825e7ad42d6894d5908d9e1eba72

SHA1
090973174d90c8ba6854a1a5d86a262d044d7074

SHA256
b64dd379e5e8fe9d19b42b524492746cb9e9e2edde806ac473459c2b3f3bb64b

SHA512
cf59921d36c872093ab2fd2f3d10f9c3a7f4e2f422b54b0d4a7db63f705d53d4acfd141962d38246da59d40b1f77f1e3ac926b638a1bf5ac25fa8d5908479837

Download Submit
C:\Users\Admin\Documents\ReceiveConvertFrom.docx.ENC

Filesize
558KB

MD5
d78c57fb900843c17c55671b72151e07

SHA1
4c13fcb955666df0127bac3597e396342645c589

SHA256
5dc3a9ba423960f7651969c5722d0ec1ca584e9e6a47615f5d79d43ef3d1b9b5

SHA512
7592ceb5bda80ae8e7cbcb426a6ccb2095806009d1f6b0c6c38fe5903c691e271f476e82a27ef8c2b34025b718e93a4f952fa632bab218d677f32e2a1eb17db0

Download Submit
C:\Users\Admin\Documents\SwitchShow.doc.ENC

Filesize
316KB

MD5
8274e0655da01c4b241347b00a76533c

SHA1
a3113eb87b6eb9ec560cf8fda181a880900bf7b1

SHA256
fc9cb0ba74ab9cb2f95defa1746215fb80c9be44890184c30df947bdbf1e4eb9

SHA512
c34de18e6589cdb49ad42e9d04186725087f805dfac66b723c50c8b3b6eba895174d96125a3385f985ada600da960b988e2bf50687782362f82c736d861e067d

Download Submit
C:\Users\Admin\Documents\UnpublishPublish.doc.ENC

Filesize
693KB

MD5
9e556ce52356fceaf6042a112f96091b

SHA1
cf75bcabdab560a87a32ce635659a43c03617a5e

SHA256
f3624785a1705082de44c131c3ed3a8b5a5b50288675de1428338907be9bf708

SHA512
c90a0d6bc0bde46828814a0fd7bc78f9db73e494adbb141fbc35cb02887fcb287851b94604c12940a529198eceb690eed5e64dbebf30572e94100c3dabd975c3

Download Submit
C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC

Filesize
16B

MD5
52786be9ac0d12123c38502248a875be

SHA1
5e00b2270c1627b6d4bca2dc1f006587b2bfd8b1

SHA256
5c5128a9bb85213184df46a265ccddb8208c8ed8faaf544894328f6f9a51ba41

SHA512
8d6e057272320092ccc9dbb7d25fa6685775071bc7e0a294b3b37ef919728d462123dde3df19ec5f6f9d9c4d365b3f37339faf5df4ef28989c53ca7e1a7b9e0d

Download Submit
memory/2268-360-0x0000000007D40000-0x0000000007F02000-memory.dmp

Filesize
1.8MB

Download
memory/2268-361-0x0000000008440000-0x000000000896C000-memory.dmp

Filesize
5.2MB

Download
memory/2268-345-0x0000000000680000-0x00000000006D2000-memory.dmp

Filesize
328KB

Download
memory/2268-346-0x00000000056D0000-0x0000000005C74000-memory.dmp

Filesize
5.6MB

Download
memory/2268-347-0x0000000005120000-0x00000000051B2000-memory.dmp

Filesize
584KB

Download
memory/2268-349-0x00000000050E0000-0x00000000050EA000-memory.dmp

Filesize
40KB

Download
memory/2268-354-0x00000000062A0000-0x00000000068B8000-memory.dmp

Filesize
6.1MB

Download
memory/2268-355-0x0000000005490000-0x000000000559A000-memory.dmp

Filesize
1.0MB

Download
memory/2268-356-0x0000000005380000-0x0000000005392000-memory.dmp

Filesize
72KB

Download
memory/2268-357-0x00000000053A0000-0x00000000053DC000-memory.dmp

Filesize
240KB

Download
memory/2268-358-0x0000000005420000-0x000000000546C000-memory.dmp

Filesize
304KB

Download
memory/2268-359-0x0000000005D80000-0x0000000005DE6000-memory.dmp

Filesize
408KB

Download
memory/2268-362-0x0000000007C00000-0x0000000007C50000-memory.dmp

Filesize
320KB

Download
memory/2752-3-0x00007FFAE2C40000-0x00007FFAE3701000-memory.dmp

Filesize
10.8MB

Download
memory/2752-18-0x00007FFAE2C40000-0x00007FFAE3701000-memory.dmp

Filesize
10.8MB

Download
memory/2752-15-0x00007FFAE2C40000-0x00007FFAE3701000-memory.dmp

Filesize
10.8MB

Download
memory/2752-14-0x00007FFAE2C40000-0x00007FFAE3701000-memory.dmp

Filesize
10.8MB

Download
memory/2752-9-0x00000226E3390000-0x00000226E33B2000-memory.dmp

Filesize
136KB

Download
memory/4572-0-0x00007FFAE2C43000-0x00007FFAE2C45000-memory.dmp

Filesize
8KB

Download
memory/4572-62-0x0000000001120000-0x000000000112C000-memory.dmp

Filesize
48KB

Download
memory/4572-58-0x00007FFAE2C40000-0x00007FFAE3701000-memory.dmp

Filesize
10.8MB

Download
memory/4572-42-0x00007FFAE2C43000-0x00007FFAE2C45000-memory.dmp

Filesize
8KB

Download
memory/4572-312-0x000000001C800000-0x000000001C80E000-memory.dmp

Filesize
56KB

Download
memory/4572-2-0x00007FFAE2C40000-0x00007FFAE3701000-memory.dmp

Filesize
10.8MB

Download
memory/4572-373-0x000000001B880000-0x000000001B9A0000-memory.dmp

Filesize
1.1MB

Download
memory/4572-1-0x0000000000A40000-0x0000000000A66000-memory.dmp

Filesize
152KB

Download