xred | 251b00319baa0ea6716fef69f337f1bfbb2697b682d7094c0429e5004b11502b

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-12-2024 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

2.6MB
MD5

9312f8185610b599fbab610623562c65
SHA1

284595f0151a56537c5a02e708b072c43123ab30
SHA256

251b00319baa0ea6716fef69f337f1bfbb2697b682d7094c0429e5004b11502b
SHA512

cbf640cffb541c128383ecc4a31bcaae6d2ddd6bd20daa5f8c92791281523802497a5e69756c8041e67d4524a9e66fce8f6e6b8810689d6078e93a16dbb6baaa
SSDEEP

49152:InsHyjtk2MYC5GDECG4hRrwCG4hdrHITYbNbNWo4kSH3OqtwIjkqXfd+/9AhD:Insmtk2aZCG4hRECG4hdLIT4bNJFY3OM

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 3 IoCs

pid	Process
320	._cache_Loader.exe
4496	Synaptics.exe
4784	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	Loader.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
33	discord.com
34	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	._cache_Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	._cache_Loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	._cache_Synaptics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	._cache_Synaptics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	._cache_Loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2437139445-1151884604-3026847218-1000\{ED1B83A8-20DF-4C35-97D0-833187AC7756}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1536	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
1072	msedge.exe
1072	msedge.exe
1192	msedge.exe
1192	msedge.exe
5800	identity_helper.exe
5800	identity_helper.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	320	._cache_Loader.exe
Token: SeDebugPrivilege	4784	._cache_Synaptics.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1536	EXCEL.EXE
1536	EXCEL.EXE
1536	EXCEL.EXE
1536	EXCEL.EXE
1536	EXCEL.EXE
1536	EXCEL.EXE
1536	EXCEL.EXE
1536	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 320	4364	Loader.exe	83
PID 4364 wrote to memory of 320	4364	Loader.exe	83
PID 4364 wrote to memory of 320	4364	Loader.exe	83
PID 4364 wrote to memory of 4496	4364	Loader.exe	84
PID 4364 wrote to memory of 4496	4364	Loader.exe	84
PID 4364 wrote to memory of 4496	4364	Loader.exe	84
PID 4496 wrote to memory of 4784	4496	Synaptics.exe	85
PID 4496 wrote to memory of 4784	4496	Synaptics.exe	85
PID 4496 wrote to memory of 4784	4496	Synaptics.exe	85
PID 4784 wrote to memory of 1072	4784	._cache_Synaptics.exe	93
PID 4784 wrote to memory of 1072	4784	._cache_Synaptics.exe	93
PID 1072 wrote to memory of 3256	1072	msedge.exe	94
PID 1072 wrote to memory of 3256	1072	msedge.exe	94
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3136	1072	msedge.exe	95
PID 1072 wrote to memory of 3672	1072	msedge.exe	96
PID 1072 wrote to memory of 3672	1072	msedge.exe	96
PID 1072 wrote to memory of 2124	1072	msedge.exe	97
PID 1072 wrote to memory of 2124	1072	msedge.exe	97
PID 1072 wrote to memory of 2124	1072	msedge.exe	97
PID 1072 wrote to memory of 2124	1072	msedge.exe	97
PID 1072 wrote to memory of 2124	1072	msedge.exe	97
PID 1072 wrote to memory of 2124	1072	msedge.exe	97
PID 1072 wrote to memory of 2124	1072	msedge.exe	97
PID 1072 wrote to memory of 2124	1072	msedge.exe	97
PID 1072 wrote to memory of 2124	1072	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Local\Temp\._cache_Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_Loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:320
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/euJUrVNY
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7fff717246f8,0x7fff71724708,0x7fff71724718
        5⤵
        
        PID:3256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12232857988695770477,16368594567446682638,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
        5⤵
        
        PID:3136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,12232857988695770477,16368594567446682638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,12232857988695770477,16368594567446682638,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
        5⤵
        
        PID:2124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12232857988695770477,16368594567446682638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
        5⤵
        
        PID:796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12232857988695770477,16368594567446682638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
        5⤵
        
        PID:4260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12232857988695770477,16368594567446682638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
        5⤵
        
        PID:1376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,12232857988695770477,16368594567446682638,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4664 /prefetch:8
        5⤵
        
        PID:4640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2148,12232857988695770477,16368594567446682638,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4784 /prefetch:8
        5⤵
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:1192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,12232857988695770477,16368594567446682638,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3616 /prefetch:8
        5⤵
        
        PID:4448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12232857988695770477,16368594567446682638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
        5⤵
        
        PID:5628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12232857988695770477,16368594567446682638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12232857988695770477,16368594567446682638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4404 /prefetch:1
        5⤵
        
        PID:5812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12232857988695770477,16368594567446682638,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
        5⤵
        
        PID:5820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12232857988695770477,16368594567446682638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
        5⤵
        
        PID:5168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12232857988695770477,16368594567446682638,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
        5⤵
        
        PID:5176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12232857988695770477,16368594567446682638,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1376 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2988

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
2.6MB

MD5
9312f8185610b599fbab610623562c65

SHA1
284595f0151a56537c5a02e708b072c43123ab30

SHA256
251b00319baa0ea6716fef69f337f1bfbb2697b682d7094c0429e5004b11502b

SHA512
cbf640cffb541c128383ecc4a31bcaae6d2ddd6bd20daa5f8c92791281523802497a5e69756c8041e67d4524a9e66fce8f6e6b8810689d6078e93a16dbb6baaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\48d42d6e-bccc-4147-8db9-42c14b92540b.tmp

Filesize
5KB

MD5
002a37803ab06fc5f311b3e2354e97f8

SHA1
94b239a3af3591fed229aeedd18b236b2f519c04

SHA256
cedc267fe81cc9e001eef79cd490338b58aa26d200733827311ea6482a2b081c

SHA512
a8b433221aef4b635c0a8932cbc941f247444aa53a961011b300ab9a4c870198d101b1df70daabc91dbe2570addd7d33d32835112493137b14c29262fe6456d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
17c2b2cdc012a1c2710b0d9f3540ea38

SHA1
83ec037d625522080fc84966a854aff8abfdb331

SHA256
2f7de3d1b24c1ab6e4fb5a11438e804ce158825f987ca2f8cce048fbbef9354f

SHA512
2e2be07fde2aa89aeefa3eeddd06f2da1c971e83fc7441cbef52dad894cfb3df32fcb85844100fdf4d6656c7c5192a6ce0b177c0a82442d14f4cdae0dd9549bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
537B

MD5
3764cdb97256a09fddd45671fa2f5738

SHA1
eca910ac96d4dcbfaddbd3f62b8cdfd966e800dc

SHA256
36a689d1d2f06fec126a85905505cd89ae90953cec7b2ee17fcb780f6b49c6cd

SHA512
38c82131d62f4d32b37a862a60481e434021b56b94475f1a80f710c2a5e25c94c6318589ef6fffcdbc946cea6bd6f9b74ffa2912ce15177384c9e547fd02f904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bdc6b958a70448c4511a0827f63c6b68

SHA1
ca8732c5e6ded2b26c58a638f58e0c20042e74d9

SHA256
b93a9308666974a39b39c6a831f6de4f1fe265634b61d3f510fc0026ec20eb6c

SHA512
fcf9abf9953181bb1b31a1792143d7c50a1948b7e94bce6459510bcbd7a5c7dd3ba6d0d5d7ac70818af456c46ad2a0268b2fdac700c0f189eb7f10f74532ffc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ed599839724581c007250a3d830b3b07

SHA1
c2e528d5d22b3cb63a38c2f44d5a094005a63395

SHA256
b72ea48a3c1e2cae70b78fb3bfe1e6a7c23f1f204e984c77c625a6c6226eff31

SHA512
9aaed676ad7bd1e7b64eeac11527718cdae90b5985dbcb1746c76dc08902c6be0338e4fd7cd684f0dd029a159c1cf64f4f20553a70ddbeb72baf37e07907d2ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
907d09c5ff8bf1a45be2443ba9d63762

SHA1
e45d70219c4240809a13c4dee61f1d2dc55ccf09

SHA256
88fb3007cb9bd88381d461921600acc7e2f120acf09ed72095ede9a79381ff12

SHA512
f7ee237a827e1c2482f7939dd37a8e109a8e16dd512c88098102308c4e0860744ae332750f72a413ca446cb1da78d353e7fd8178d8bfedc4287889d7567116eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Filesize
2KB

MD5
5f853f30e21465e926770810cbfde3ed

SHA1
e42ea35fd5920e59b186af10c557c77df800cf72

SHA256
18e3410f311009cfa783c6441585e08d13dfbe8f7acaa5efba67517fd75a5a05

SHA512
a82595bd94cfdec8d6c9a97512bccaa2346b721954cc3fb498bce0810545083f1c10f5eaf98df400bccbc466d70bc267056996b8acbda8683ccf8b7e16c902dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_Loader.exe

Filesize
1.9MB

MD5
642be5ba47f59f56b1e8409b54ae78ca

SHA1
37fb49ce8927d9cf46afbe15ec67bc0ac0833376

SHA256
ab549bf47c08184f8ab98f8df682c394048771096ad5d436ddd950e550517a2c

SHA512
2da1440d6e30b31b975460a16727841a681c970d05a80e4fc30b616b1e53e511898720fb3e148a0cd9a6ba4b1b8ba28a68dc601621f4898c6dd572ce7a81e096

Download Submit
C:\Users\Admin\AppData\Local\Temp\3DC75E00

Filesize
26KB

MD5
dbca791d6de7e6f55cd6f5f6a98f162e

SHA1
08af484f6ee5570ef818583c9f66f4013fdd62f0

SHA256
4239cc4cbe57558f7bb12b3e4806f4ac1fb4fbbad16c3b82819eb98e9b80d12a

SHA512
7584d22d28c7c654981f634e97142b4677aa8c6b83e2fb953bfe46122a27425f4ae55e475cef24507145f8470b7e22df71cc23d6423c9f6a07e67488f5d25d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\sgzrKSEI.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
memory/320-137-0x0000000005720000-0x0000000005730000-memory.dmp

Filesize
64KB

Download
memory/320-203-0x0000000007A50000-0x0000000007A8C000-memory.dmp

Filesize
240KB

Download
memory/320-70-0x0000000072A5E000-0x0000000072A5F000-memory.dmp

Filesize
4KB

Download
memory/320-116-0x0000000000A80000-0x0000000000C66000-memory.dmp

Filesize
1.9MB

Download
memory/320-127-0x0000000005CE0000-0x0000000006284000-memory.dmp

Filesize
5.6MB

Download
memory/320-132-0x0000000005650000-0x00000000056E2000-memory.dmp

Filesize
584KB

Download
memory/320-136-0x0000000005600000-0x0000000005612000-memory.dmp

Filesize
72KB

Download
memory/320-271-0x0000000072A5E000-0x0000000072A5F000-memory.dmp

Filesize
4KB

Download
memory/320-283-0x0000000005720000-0x0000000005730000-memory.dmp

Filesize
64KB

Download
memory/320-200-0x00000000095A0000-0x00000000098F4000-memory.dmp

Filesize
3.3MB

Download
memory/320-199-0x00000000079B0000-0x00000000079D2000-memory.dmp

Filesize
136KB

Download
memory/320-198-0x00000000078C0000-0x0000000007972000-memory.dmp

Filesize
712KB

Download
memory/320-139-0x0000000005A00000-0x0000000005C14000-memory.dmp

Filesize
2.1MB

Download
memory/320-138-0x0000000005830000-0x000000000583A000-memory.dmp

Filesize
40KB

Download
memory/1536-209-0x00007FFF53020000-0x00007FFF53030000-memory.dmp

Filesize
64KB

Download
memory/1536-210-0x00007FFF53020000-0x00007FFF53030000-memory.dmp

Filesize
64KB

Download
memory/1536-205-0x00007FFF550B0000-0x00007FFF550C0000-memory.dmp

Filesize
64KB

Download
memory/1536-208-0x00007FFF550B0000-0x00007FFF550C0000-memory.dmp

Filesize
64KB

Download
memory/1536-207-0x00007FFF550B0000-0x00007FFF550C0000-memory.dmp

Filesize
64KB

Download
memory/1536-206-0x00007FFF550B0000-0x00007FFF550C0000-memory.dmp

Filesize
64KB

Download
memory/1536-204-0x00007FFF550B0000-0x00007FFF550C0000-memory.dmp

Filesize
64KB

Download
memory/4364-0-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/4364-131-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/4496-282-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/4496-133-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/4496-415-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/4496-507-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download