nanocore | 05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743

Analysis

max time kernel
104s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 06:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.exe
Size

567KB
MD5

5c1cd29e458e43381dee5769b9c39db0
SHA1

f936c464cf2ae05817ca83392f3bf0132cb93033
SHA256

05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743
SHA512

16e2eb7c19050c963c1613402382889525222beda60542d4177434bc3716296e3fba3565f1e406717b2e6fb4a9079721cb2ca4b729a5c3f54d23a2067cfaa289
SSDEEP

6144:NJUJOAPzekZusrr7nDbOpkexqknYSQpJH1PD9YVDsKmTFGHXrkYOCxrgbe1Ig9:NgPzeWapkexqRYV7mAiCJg/g9

Score

10^/10

nanocore discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

69.61.59.215:60003

cldgr.duckdns.org:60003

Mutex

0c1e37c4-6fe0-4fbd-a4f4-dbf4c0453c4a

Attributes

activate_away_mode
false
backup_connection_host
cldgr.duckdns.org
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-08-14T15:52:11.646113636Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
60003
default_group
winter
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
0c1e37c4-6fe0-4fbd-a4f4-dbf4c0453c4a
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
69.61.59.215
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Nanocore family
nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ProPlayer = "C:\\Users\\Admin\\AppData\\Roaming\\ProPlayer\\Player.exe.exe"	05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2588 set thread context of 3208	2588	05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.exe	91

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
3168	msedge.exe
3168	msedge.exe
3688	identity_helper.exe
3688	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2588	05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 3208	2588	05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.exe	91
PID 2588 wrote to memory of 3208	2588	05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.exe	91
PID 2588 wrote to memory of 3208	2588	05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.exe	91
PID 2588 wrote to memory of 3208	2588	05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.exe	91
PID 2588 wrote to memory of 3208	2588	05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.exe	91
PID 2588 wrote to memory of 3208	2588	05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.exe	91
PID 2588 wrote to memory of 3208	2588	05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.exe	91
PID 2588 wrote to memory of 3208	2588	05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.exe	91
PID 3208 wrote to memory of 3168	3208	05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.EXE	97
PID 3208 wrote to memory of 3168	3208	05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.EXE	97
PID 3168 wrote to memory of 2536	3168	msedge.exe	98
PID 3168 wrote to memory of 2536	3168	msedge.exe	98
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4672	3168	msedge.exe	100
PID 3168 wrote to memory of 4196	3168	msedge.exe	101
PID 3168 wrote to memory of 4196	3168	msedge.exe	101
PID 3168 wrote to memory of 5016	3168	msedge.exe	102
PID 3168 wrote to memory of 5016	3168	msedge.exe	102
PID 3168 wrote to memory of 5016	3168	msedge.exe	102
PID 3168 wrote to memory of 5016	3168	msedge.exe	102
PID 3168 wrote to memory of 5016	3168	msedge.exe	102
PID 3168 wrote to memory of 5016	3168	msedge.exe	102
PID 3168 wrote to memory of 5016	3168	msedge.exe	102
PID 3168 wrote to memory of 5016	3168	msedge.exe	102
PID 3168 wrote to memory of 5016	3168	msedge.exe	102
PID 3168 wrote to memory of 5016	3168	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.exe
"C:\Users\Admin\AppData\Local\Temp\05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Local\Temp\05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.EXE
  "C:\Users\Admin\AppData\Local\Temp\05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.EXE"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.EXE&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa209646f8,0x7ffa20964708,0x7ffa20964718
      4⤵
      PID:2536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,8156997514054213586,17126771468696813172,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,8156997514054213586,17126771468696813172,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,8156997514054213586,17126771468696813172,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8156997514054213586,17126771468696813172,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8156997514054213586,17126771468696813172,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8156997514054213586,17126771468696813172,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
      4⤵
      PID:2964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,8156997514054213586,17126771468696813172,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,8156997514054213586,17126771468696813172,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8156997514054213586,17126771468696813172,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8156997514054213586,17126771468696813172,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
      4⤵
      PID:4012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8156997514054213586,17126771468696813172,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8156997514054213586,17126771468696813172,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8156997514054213586,17126771468696813172,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8156997514054213586,17126771468696813172,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
      4⤵
      PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=05b36f97235b55ac54f925bae607ac4cbe074a64061cbd4ec6e73008c5233743N.EXE&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa209646f8,0x7ffa20964708,0x7ffa20964718
      4⤵
      PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e342f0f-edd8-42a9-8844-9a9d5c32421d.tmp

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
dfa47e3cce3a1be654fd82b104472af0

SHA1
a3005e217fefedcf0a802d57a91d0c00cd458d66

SHA256
d93d03113dfdfdc1d35cb6723ab61950b10b2775d3ea167e30a14e1462e513d2

SHA512
4ed5e11dd2444ef4b1e5566093c46a777bbe9e0a83d87ddb707ccf25e9d6b806b5b35bf7c6d4845f9ca0515f01e0f03de3dcacba2911159ab3373884587b7a75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2fdd7332fb7eea578be0d300353692b3

SHA1
4c6d2f27e84d0167b1da08aa2775b6ff917f76d4

SHA256
f809e27560aaab99be1ecbedfbe9c1499a6affd0e70f19120492eb36e2d7ac11

SHA512
22bcd4e653b6d5d7d20abcd836747cef06b45d17b9746cfaac28c69de68eab54bdae8153856770d709f3fbf373ea561fd115c150b6e9f86b3ac026692d72b394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e4fc6589acab87f937e620a2181ee2b3

SHA1
bd0334c6f60fe42724a6bb02c8585bedfff17f60

SHA256
460c1520490f7358527963336cfea1229b116722f6e461355fe262b57abe6b5d

SHA512
1990f79ce96c18154d025d1c06a81a2486ada17cfbcd130ea6ca67d006c71cc408b081182d2a3cb95cd188ba1475f3a8bdfa9741e2db8c05e7b7b4727f70721f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca4e10459c9182be404c5aa7094f2956

SHA1
621f982bf84444f965f2709aed7ae09da3582376

SHA256
80e403dbaa30e46a40cf39943a8d2fd9bb3c4927b820f691558b7b30b8354941

SHA512
f3fe30f58955e11f015f13bfe86b6577d6d9249c53a93fee0c713e42164b8dd2985ed27d92a4b746ba43d141530498bf8b01c494795bcd15ae8aaa8dcd679c7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
eccc45a238e9173981f8ad8310505701

SHA1
8c4ce61bc194ed2ad5f54ab4309039c5dd276027

SHA256
e68cca64869aee2470bf7cb35b426a68ff307475533b2473c87dd567aed41813

SHA512
ec477c8ba512b09696fd0db6c8235755cee36ea461d1c073650ec3898ea47cd22dcf7a785758bbda1b9ef9d2a7ec5c25f15eed9785f68765e62b7d6ee9b591fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580088.TMP

Filesize
371B

MD5
af64bb71661dd47237d3225e0d20ee0b

SHA1
146afec9a5f03f5c4a90ffa400dd1ae3badccba9

SHA256
5287e077553f8e2e799ff923f7dc0eb94eb6459d06b6d3089a800a3411175801

SHA512
ec453047dbc875412994afb1dcadc468235f9d5bbba4e98540bbfe9808b27910b02702308b6f68a3949e5c7b55adfa715f2a9c68a643818d5d5c157a239d346f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
439347da7a88dde54ba9249c2006f744

SHA1
59e880142356626b59fffef88b100bb93d4f8c51

SHA256
587ab32e53b2d3311995048c864750178d7edde63425fd37f6aacf43466315ce

SHA512
7058a0b66611d9fae3b8651c59fa6e65f5af6904e0dd07297a083cea08b54eff1e04e0870962a1ac0f5ed77a61a0483bafada0c7cf5079aaa092e5e622839416

Download Submit
memory/3208-2-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download