redline | 4d0f2f8fd89fec7e4f1348b5b6a0ea528d2b391f48e69df140b91845c0989abe

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

spoolsv.exe
Size

125KB
MD5

02201ab0ffca3905fbf110296fd58298
SHA1

4068eb4c09f6e09637588ee3cf62bf7229a25faa
SHA256

4d0f2f8fd89fec7e4f1348b5b6a0ea528d2b391f48e69df140b91845c0989abe
SHA512

4f2d86d8dbdb6946bdd982b7c48aea803eccd99c51ddbd6edcb1f7301f9a8f255953210b5b47ecd6e6a8f1bf93269bb519b3a83548f7d3ea63ded3980bef3705
SSDEEP

1536:Rn7TvjnE1RowM/gZbgjx1LAYivy6sDOsyrXdtyVt3A7HPd4n+lbeRZIbSQPYU:RHovoX/0bgAoORHyHQbPRyZ2pPYU

Score

10^/10

redline stormkitty xworm l3monlogs discovery execution infostealer persistence ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

l3monlogs

78.70.235.238:1912

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/3744-61-0x000000001D780000-0x000000001D78E000-memory.dmp	disable_win_def

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3744-1-0x0000000000A20000-0x0000000000A46000-memory.dmp	family_xworm
behavioral2/files/0x000e000000023ba9-58.dat	family_xworm

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000200000001e762-65.dat	family_redline
behavioral2/memory/2748-73-0x0000000000B00000-0x0000000000B52000-memory.dmp	family_redline

Redline family
redline
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/3744-72-0x000000001E750000-0x000000001E870000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1844	powershell.exe
4400	powershell.exe
1804	powershell.exe
2120	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	spoolsv.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.lnk	spoolsv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.lnk	spoolsv.exe

Executes dropped EXE 4 IoCs

pid	Process
4704	spoolsv.exe
2748	isiymv.exe
4936	spoolsv.exe
1120	spoolsv.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "C:\\Users\\Admin\\AppData\\Roaming\\spoolsv.exe"	spoolsv.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	spoolsv.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	isiymv.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1844	powershell.exe
1844	powershell.exe
4400	powershell.exe
4400	powershell.exe
1804	powershell.exe
1804	powershell.exe
2120	powershell.exe
2120	powershell.exe
3744	spoolsv.exe
3744	spoolsv.exe
3744	spoolsv.exe
2748	isiymv.exe
2748	isiymv.exe
2748	isiymv.exe
4956	msedge.exe
4956	msedge.exe
5016	msedge.exe
5016	msedge.exe
3540	identity_helper.exe
3540	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3744	spoolsv.exe
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeDebugPrivilege	2120	powershell.exe
Token: SeDebugPrivilege	3744	spoolsv.exe
Token: SeDebugPrivilege	4704	spoolsv.exe
Token: SeDebugPrivilege	2748	isiymv.exe
Token: SeDebugPrivilege	4936	spoolsv.exe
Token: SeDebugPrivilege	1120	spoolsv.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3744	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 1844	3744	spoolsv.exe	87
PID 3744 wrote to memory of 1844	3744	spoolsv.exe	87
PID 3744 wrote to memory of 4400	3744	spoolsv.exe	89
PID 3744 wrote to memory of 4400	3744	spoolsv.exe	89
PID 3744 wrote to memory of 1804	3744	spoolsv.exe	93
PID 3744 wrote to memory of 1804	3744	spoolsv.exe	93
PID 3744 wrote to memory of 2120	3744	spoolsv.exe	95
PID 3744 wrote to memory of 2120	3744	spoolsv.exe	95
PID 3744 wrote to memory of 4624	3744	spoolsv.exe	100
PID 3744 wrote to memory of 4624	3744	spoolsv.exe	100
PID 3744 wrote to memory of 2748	3744	spoolsv.exe	109
PID 3744 wrote to memory of 2748	3744	spoolsv.exe	109
PID 3744 wrote to memory of 2748	3744	spoolsv.exe	109
PID 3744 wrote to memory of 5016	3744	spoolsv.exe	115
PID 3744 wrote to memory of 5016	3744	spoolsv.exe	115
PID 5016 wrote to memory of 2528	5016	msedge.exe	116
PID 5016 wrote to memory of 2528	5016	msedge.exe	116
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 2136	5016	msedge.exe	117
PID 5016 wrote to memory of 4956	5016	msedge.exe	118
PID 5016 wrote to memory of 4956	5016	msedge.exe	118
PID 5016 wrote to memory of 4088	5016	msedge.exe	119
PID 5016 wrote to memory of 4088	5016	msedge.exe	119
PID 5016 wrote to memory of 4088	5016	msedge.exe	119
PID 5016 wrote to memory of 4088	5016	msedge.exe	119
PID 5016 wrote to memory of 4088	5016	msedge.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
"C:\Users\Admin\AppData\Local\Temp\spoolsv.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2120
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "spoolsv" /tr "C:\Users\Admin\AppData\Roaming\spoolsv.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4624
- C:\Users\Admin\AppData\Local\Temp\isiymv.exe
  "C:\Users\Admin\AppData\Local\Temp\isiymv.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffc4c4846f8,0x7ffc4c484708,0x7ffc4c484718
    3⤵
    PID:2528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7962893946740844356,12115134887009194827,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,7962893946740844356,12115134887009194827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,7962893946740844356,12115134887009194827,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7962893946740844356,12115134887009194827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7962893946740844356,12115134887009194827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7962893946740844356,12115134887009194827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7962893946740844356,12115134887009194827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7962893946740844356,12115134887009194827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7962893946740844356,12115134887009194827,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7962893946740844356,12115134887009194827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7962893946740844356,12115134887009194827,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
    3⤵
    PID:1124

C:\Users\Admin\AppData\Roaming\spoolsv.exe
C:\Users\Admin\AppData\Roaming\spoolsv.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Users\Admin\AppData\Roaming\spoolsv.exe
C:\Users\Admin\AppData\Roaming\spoolsv.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1916

C:\Users\Admin\AppData\Roaming\spoolsv.exe
C:\Users\Admin\AppData\Roaming\spoolsv.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\spoolsv.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
61290f1b8952dc3824b4f1ab04c9f709

SHA1
5f68aff3c4dd441818327083d427f0b2288aea16

SHA256
6c37f5c30617afa3524911776d1775a9a8d61cf2014bb9ad8b8b20e4955dbc9a

SHA512
6397cd4bc467f04256e0f406b7b48d81e7e622c5956bcf0ac9714bdf49041cef24a922b90004b93ee5d23af0d222136e95cc597adfeb9198d52d23e7f7ed1e38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
45725eb444ba728f1b9a945896298a1f

SHA1
a8786fe742710c466e41a4f8ac3ad9869291f96f

SHA256
264578cbae19513ee13fa947044073ddfb2585816387429ac1aef426678f61cc

SHA512
d45597e2364874ed1c06b4b7f972772e7988e5e57277c06bb336f33fcd4bd6a6458f071546ccf157845eb15eeae5bc9ccaaf719e25727f5f698c21fc0b9a6986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
49eae365c5ee01bfd657701a39db3702

SHA1
19e2ea1f4758892eef6169b1292c9403c45127c7

SHA256
e73cfb87d5e100acbb7f67ea9867821f22cf7a003216e0a195f792476275fbfe

SHA512
1a87bc52aa6ffeb3e7de72ec0382b02c0f0cc66511ed5ea216ebf976a069b6691022c5613d754040062bce1a48a1a07adb778b68c6147dc14da4d9b9f9e99e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4b9acf8eb4e89637e2aaf064b06c6aff

SHA1
d41812b7402b7a140a9626ca878cdd9b1ad50d8d

SHA256
f4a96d97aada1eb8cd0fce3795bbcd224c587b424a36a4c69d3d15b2e3e2c8b7

SHA512
31aa727bebbf760086fce8916d375e6dffb57170b621fa148feff38dba5659a0ae895753841e69c87827a7faec15a15c7b40aec244df330bb47f75a67f0ce522

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d3e8199b4634731cf0a0c26c1f14f588

SHA1
7f8fae27eb80055a436a6b5457978f32673d9ad4

SHA256
ef33f487f93c2977e92fb08d6bdcc9d48b5d1864c402f9d3fbf3e1b30e8b3b9a

SHA512
806a123100dbc1ca1b27bbad5b93c3a9a840dc795127af8523333a71259a8c5ef8aefccb83ef390f2644e013f138c4b7b63c584acccb197aada0c70c038032e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ynk3ll04.r4j.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\isiymv.exe

Filesize
300KB

MD5
dfefdd2e554fd23f3b87f68c3e0f9622

SHA1
8be107d3c7e0aba6346ccdac289e29e3a8127af2

SHA256
f47c2bb84ce619d0d69445b0a1dce760482f2dd508815ba2667bab5c3a3541e9

SHA512
8f11525da059c6aa655d5ad2c41f89ce535ebb7a2bd4d7ce197c2ea244f28947e2338b1f97378130179490e49fd73402ee3dcdc507901f48b41ce9acf79ca182

Download Submit
C:\Users\Admin\AppData\Roaming\spoolsv.exe

Filesize
125KB

MD5
02201ab0ffca3905fbf110296fd58298

SHA1
4068eb4c09f6e09637588ee3cf62bf7229a25faa

SHA256
4d0f2f8fd89fec7e4f1348b5b6a0ea528d2b391f48e69df140b91845c0989abe

SHA512
4f2d86d8dbdb6946bdd982b7c48aea803eccd99c51ddbd6edcb1f7301f9a8f255953210b5b47ecd6e6a8f1bf93269bb519b3a83548f7d3ea63ded3980bef3705

Download Submit
C:\Users\Admin\Desktop\How To Decrypt My Files.html

Filesize
639B

MD5
d2dbbc3383add4cbd9ba8e1e35872552

SHA1
020abbc821b2fe22c4b2a89d413d382e48770b6f

SHA256
5ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be

SHA512
bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66

Download Submit
C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC

Filesize
16B

MD5
a33eed63c2ef991301e729883a443f36

SHA1
24c9e2bfa12f60cf12b2ac4ec7928e3ddff411af

SHA256
29fbcd77c8407675d258c49c5a35abbccbc298640f62e805912e69b94144aada

SHA512
05521d1fc1402056d274ef2fe7a7120448840c4334910cd2b0a00fe88b301a50f2fa2ebbc1d584ea0aa0f6c371b33e00dfbf6390a191502af9697c30a60bfb29

Download Submit
memory/1844-18-0x00007FFC4FD40000-0x00007FFC50801000-memory.dmp

Filesize
10.8MB

Download
memory/1844-3-0x00007FFC4FD40000-0x00007FFC50801000-memory.dmp

Filesize
10.8MB

Download
memory/1844-13-0x00007FFC4FD40000-0x00007FFC50801000-memory.dmp

Filesize
10.8MB

Download
memory/1844-14-0x00007FFC4FD40000-0x00007FFC50801000-memory.dmp

Filesize
10.8MB

Download
memory/1844-15-0x0000026A5D250000-0x0000026A5D272000-memory.dmp

Filesize
136KB

Download
memory/2748-120-0x00000000059D0000-0x0000000005A1C000-memory.dmp

Filesize
304KB

Download
memory/2748-75-0x0000000005550000-0x00000000055E2000-memory.dmp

Filesize
584KB

Download
memory/2748-118-0x00000000057F0000-0x0000000005802000-memory.dmp

Filesize
72KB

Download
memory/2748-119-0x0000000005850000-0x000000000588C000-memory.dmp

Filesize
240KB

Download
memory/2748-116-0x00000000065F0000-0x0000000006C08000-memory.dmp

Filesize
6.1MB

Download
memory/2748-73-0x0000000000B00000-0x0000000000B52000-memory.dmp

Filesize
328KB

Download
memory/2748-117-0x00000000058C0000-0x00000000059CA000-memory.dmp

Filesize
1.0MB

Download
memory/2748-123-0x0000000006100000-0x0000000006166000-memory.dmp

Filesize
408KB

Download
memory/2748-124-0x0000000006F50000-0x0000000006FA0000-memory.dmp

Filesize
320KB

Download
memory/2748-125-0x0000000007E60000-0x0000000008022000-memory.dmp

Filesize
1.8MB

Download
memory/2748-126-0x0000000008560000-0x0000000008A8C000-memory.dmp

Filesize
5.2MB

Download
memory/2748-76-0x0000000005620000-0x000000000562A000-memory.dmp

Filesize
40KB

Download
memory/2748-74-0x0000000005A20000-0x0000000005FC4000-memory.dmp

Filesize
5.6MB

Download
memory/3744-122-0x000000001B750000-0x000000001B75E000-memory.dmp

Filesize
56KB

Download
memory/3744-131-0x0000000001200000-0x000000000120C000-memory.dmp

Filesize
48KB

Download
memory/3744-121-0x000000001EF40000-0x000000001F290000-memory.dmp

Filesize
3.3MB

Download
memory/3744-72-0x000000001E750000-0x000000001E870000-memory.dmp

Filesize
1.1MB

Download
memory/3744-61-0x000000001D780000-0x000000001D78E000-memory.dmp

Filesize
56KB

Download
memory/3744-57-0x00007FFC4FD40000-0x00007FFC50801000-memory.dmp

Filesize
10.8MB

Download
memory/3744-0-0x00007FFC4FD43000-0x00007FFC4FD45000-memory.dmp

Filesize
8KB

Download
memory/3744-2-0x00007FFC4FD40000-0x00007FFC50801000-memory.dmp

Filesize
10.8MB

Download
memory/3744-1-0x0000000000A20000-0x0000000000A46000-memory.dmp

Filesize
152KB

Download