cybergate | 55a5b5ca5878f2ce975ae2800c6547fdbca21dac1e7cbfe1f0fc75933a1a6bbf

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2025 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6946050338e8c97479ae653ffbfc4020.exe
Size

528KB
MD5

6946050338e8c97479ae653ffbfc4020
SHA1

c35b5d0f5c820765a00e77887d093cae91d4d919
SHA256

55a5b5ca5878f2ce975ae2800c6547fdbca21dac1e7cbfe1f0fc75933a1a6bbf
SHA512

b9c5d35bdd344596aef8a7b2929a3b8ce4b0ff0c3b7593216a3349fd2ce29d516b95eac66148ef0239098a1a8a0ad13f0e554c8df4723c0ca353e287afa7a2be
SSDEEP

12288:rSdPeMcE2P7eSkb2A3FiEIIwq4yc8LKAd/vf0Frwxl:+dPkE2a2A3FL3gLYKA2Frwx

Score

10^/10

cybergate firmw discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.7 Final

Botnet

firmw

pardo123.no-ip.biz:1000

Mutex

lakfsdjsadkjlskjfh

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
microsoft
install_file
host.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
123
regkey_hkcu
java updater
regkey_hklm
system32

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{55LY2307-0775-USG6-YTS7-1158WUNNK8TR}	cvtres.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{55LY2307-0775-USG6-YTS7-1158WUNNK8TR}\StubPath = "C:\\Windows\\system32\\microsoft\\host.exe Restart"	cvtres.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{55LY2307-0775-USG6-YTS7-1158WUNNK8TR}	cvtres.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{55LY2307-0775-USG6-YTS7-1158WUNNK8TR}\StubPath = "C:\\Windows\\system32\\microsoft\\host.exe"	cvtres.exe

Executes dropped EXE 28 IoCs

pid	Process
7728	host.exe
8056	host.exe
5004	host.exe
1640	host.exe
2304	host.exe
2272	host.exe
2908	host.exe
4336	host.exe
1712	host.exe
4784	host.exe
2840	host.exe
5264	host.exe
5728	host.exe
6028	host.exe
5200	host.exe
5916	host.exe
5808	host.exe
5420	host.exe
6460	host.exe
6496	host.exe
6860	host.exe
6216	host.exe
6832	host.exe
6228	host.exe
6900	host.exe
7080	host.exe
6276	host.exe
4928	host.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\18.exe = "C:\\Users\\Admin\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe"	JaffaCakes118_6946050338e8c97479ae653ffbfc4020.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\18.exe = "C:\\Users\\Admin\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe"	JaffaCakes118_6946050338e8c97479ae653ffbfc4020.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system32 = "C:\\Windows\\system32\\microsoft\\host.exe"	cvtres.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java updater = "C:\\Windows\\system32\\microsoft\\host.exe"	cvtres.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\microsoft\host.exe	cvtres.exe
File opened for modification	C:\Windows\SysWOW64\microsoft\host.exe	cvtres.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2888 set thread context of 3352	2888	JaffaCakes118_6946050338e8c97479ae653ffbfc4020.exe	84

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3352-5-0x0000000000400000-0x00000000004AD000-memory.dmp	upx
behavioral2/memory/3352-9-0x0000000000400000-0x00000000004AD000-memory.dmp	upx
behavioral2/memory/3352-10-0x0000000000400000-0x00000000004AD000-memory.dmp	upx
behavioral2/memory/3352-11-0x0000000000400000-0x00000000004AD000-memory.dmp	upx
behavioral2/memory/3352-1407-0x0000000000400000-0x00000000004AD000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5400	1928	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6946050338e8c97479ae653ffbfc4020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
2416	msedge.exe
2416	msedge.exe
3352	cvtres.exe
3352	cvtres.exe
5224	identity_helper.exe
5224	identity_helper.exe
6524	msedge.exe
6524	msedge.exe
6524	msedge.exe
6524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
3352	cvtres.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2416	2888	JaffaCakes118_6946050338e8c97479ae653ffbfc4020.exe	82
PID 2888 wrote to memory of 2416	2888	JaffaCakes118_6946050338e8c97479ae653ffbfc4020.exe	82
PID 2416 wrote to memory of 4880	2416	msedge.exe	83
PID 2416 wrote to memory of 4880	2416	msedge.exe	83
PID 2888 wrote to memory of 3352	2888	JaffaCakes118_6946050338e8c97479ae653ffbfc4020.exe	84
PID 2888 wrote to memory of 3352	2888	JaffaCakes118_6946050338e8c97479ae653ffbfc4020.exe	84
PID 2888 wrote to memory of 3352	2888	JaffaCakes118_6946050338e8c97479ae653ffbfc4020.exe	84
PID 2888 wrote to memory of 3352	2888	JaffaCakes118_6946050338e8c97479ae653ffbfc4020.exe	84
PID 2888 wrote to memory of 3352	2888	JaffaCakes118_6946050338e8c97479ae653ffbfc4020.exe	84
PID 2888 wrote to memory of 3352	2888	JaffaCakes118_6946050338e8c97479ae653ffbfc4020.exe	84
PID 2888 wrote to memory of 3352	2888	JaffaCakes118_6946050338e8c97479ae653ffbfc4020.exe	84
PID 2888 wrote to memory of 3352	2888	JaffaCakes118_6946050338e8c97479ae653ffbfc4020.exe	84
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 560	2416	msedge.exe	85
PID 2416 wrote to memory of 1912	2416	msedge.exe	86
PID 2416 wrote to memory of 1912	2416	msedge.exe	86
PID 2416 wrote to memory of 784	2416	msedge.exe	87
PID 2416 wrote to memory of 784	2416	msedge.exe	87
PID 2416 wrote to memory of 784	2416	msedge.exe	87
PID 2416 wrote to memory of 784	2416	msedge.exe	87
PID 2416 wrote to memory of 784	2416	msedge.exe	87
PID 2416 wrote to memory of 784	2416	msedge.exe	87
PID 2416 wrote to memory of 784	2416	msedge.exe	87
PID 2416 wrote to memory of 784	2416	msedge.exe	87
PID 2416 wrote to memory of 784	2416	msedge.exe	87
PID 2416 wrote to memory of 784	2416	msedge.exe	87

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3432
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6946050338e8c97479ae653ffbfc4020.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6946050338e8c97479ae653ffbfc4020.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.ztedevice.com/support/selectproduct.html?type=software
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc45246f8,0x7ffdc4524708,0x7ffdc4524718
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12234452186159937643,4006368743649968459,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
      4⤵
      PID:560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,12234452186159937643,4006368743649968459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,12234452186159937643,4006368743649968459,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
      4⤵
      PID:784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12234452186159937643,4006368743649968459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
      4⤵
      PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12234452186159937643,4006368743649968459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12234452186159937643,4006368743649968459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12234452186159937643,4006368743649968459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,12234452186159937643,4006368743649968459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4088 /prefetch:8
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,12234452186159937643,4006368743649968459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4088 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12234452186159937643,4006368743649968459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12234452186159937643,4006368743649968459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12234452186159937643,4006368743649968459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:7116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12234452186159937643,4006368743649968459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
      4⤵
      PID:7512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12234452186159937643,4006368743649968459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:1
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12234452186159937643,4006368743649968459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
      4⤵
      PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12234452186159937643,4006368743649968459,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5316 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6524
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:3352
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1928
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 852
        5⤵
        Program crash
        
        PID:5400
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:5896
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe"
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      System Location Discovery: System Language Discovery
      PID:5960
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:7728
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:8056
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5004
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1640
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2304
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2272
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2908
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4336
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1712
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4784
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2840
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5264
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5728
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6028
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5200
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5916
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5808
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5420
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6460
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6496
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6860
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6216
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6832
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6228
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6900
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:7080
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6276
    - - C:\Windows\SysWOW64\microsoft\host.exe
        
        "C:\Windows\system32\microsoft\host.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1928 -ip 1928
1⤵
PID:5332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f1e80eb304324784f0cbb359953a43a4

SHA1
1879725c58386154bf2b6f5ac13539ed3d71a7de

SHA256
32132787e4eec235443dea0f57e9a314a8ec61ba3bfd85ce6112a0b16e67fb27

SHA512
320a3a8a9fc7bf4991ec34b637311dad23301e7b9ad44bb885bf8dec0c552aa562fe1e9a761c2ed3d4edce9a50c324254f55717f7c099041953d8ba91e4cf66f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
658bab37235de25fcdbcdfc197f69d53

SHA1
5db65ef842b4e50e12178fbc70af63da69d4b412

SHA256
ea2c29f649a02fe4bf6e878e4d8bb51342659b85ac4d9069ec4cef34db61261f

SHA512
27c7f8698d210db94b662c3c20b15fd813291bfca4bc0f707c7c41c0de426dc36a16cbad69fdfbc5a41c109e7b9bd487c1a3b0932715839621f37e385c480f53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9344ff2f32610b340a46009a16b93358

SHA1
5316a25fb8914e997a30941f2a3ed08a2cfb7eb7

SHA256
a5702d12525ad00d2869af1fce4e6a12b5799f0d1fbdcd4b1377d66cfe778ae5

SHA512
4fc7793cc58bf586d4a529c6953d120875476df42152881c34e62e412227ad92b731d19cc8c2f86078bfe1b1f8c8c1d73b704d8fd14bfb25719fa979f5653785

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
588KB

MD5
d7b7f107057f06c045f2ecffa66c90b7

SHA1
f2a5c8dfdac419c385bcf8008b49190eea645a2d

SHA256
c7291b76824d75705cca5ec6787b2160762cf43f58db36ffea981e77834e3a99

SHA512
0562332f494248b82209b6b277d8c1a7524fd02d9c1c341bc6530358d1ee7a61bd459f3d4afedace6d77129d60191b6d4ff45ebfa65e52713b8670cbb062d10a

Download Submit
C:\Windows\SysWOW64\microsoft\host.exe

Filesize
34KB

MD5
e118330b4629b12368d91b9df6488be0

SHA1
ce90218c7e3b90df2a3409ec253048bb6472c2fd

SHA256
3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

SHA512
ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

Download Submit
memory/1928-714-0x0000000010470000-0x00000000104CC000-memory.dmp

Filesize
368KB

Download
memory/1928-1429-0x0000000010470000-0x00000000104CC000-memory.dmp

Filesize
368KB

Download
memory/1928-44-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1928-45-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/2888-12-0x0000000074E80000-0x0000000075431000-memory.dmp

Filesize
5.7MB

Download
memory/2888-1-0x0000000074E80000-0x0000000075431000-memory.dmp

Filesize
5.7MB

Download
memory/2888-2-0x0000000074E80000-0x0000000075431000-memory.dmp

Filesize
5.7MB

Download
memory/2888-0-0x0000000074E82000-0x0000000074E83000-memory.dmp

Filesize
4KB

Download
memory/3352-11-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/3352-43-0x0000000010470000-0x00000000104CC000-memory.dmp

Filesize
368KB

Download
memory/3352-1407-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/3352-37-0x0000000010410000-0x000000001046C000-memory.dmp

Filesize
368KB

Download
memory/3352-36-0x0000000010410000-0x000000001046C000-memory.dmp

Filesize
368KB

Download
memory/3352-10-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/3352-9-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/3352-5-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download