njrat | 81abb1776a5da5c7844a18f50a4f254eed232c6164b62e2a5fd69d4494c4b943

Analysis

max time kernel
899s
max time network
897s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2025 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

antivirus by emil v1.0.exe
Size

43KB
MD5

04b503df0753a8a4bf74035949215a47
SHA1

fde82e54526910d082a80853730969888d86befd
SHA256

81abb1776a5da5c7844a18f50a4f254eed232c6164b62e2a5fd69d4494c4b943
SHA512

4608a20bfb499bc6a0ca89cab7d080f76f3d7fb2c730492bfa6d7f6301bd50b24af7f228c6a1b5ac06f033c7367fb580279446407bfdad0004669dbdfeb82da2
SSDEEP

384:FZyd5ctOnwtOyW60GmciXEFdZBEk0z2I1zgIij+ZsNO3PlpJKkkjh/TzF7pWn3J8:PuqAwt/W6NmciXEF3p0zxuXQ/oI6+L

Score

10^/10

njrat hacked discovery trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

both-foundations.gl.at.ply.gg:60732

Mutex

Microsoft Edge Updater

Attributes

reg_key
Microsoft Edge Updater
splitter
|Hassan|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	antivirus by emil v1.0.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.exe	MicrosoftEdgeUpdater.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.exe	MicrosoftEdgeUpdater.exe

Executes dropped EXE 16 IoCs

pid	Process
4540	MicrosoftEdgeUpdater.exe
2508	Server.exe
1008	Server.exe
5048	Server.exe
4748	Server.exe
5056	Server.exe
1896	Server.exe
2456	Server.exe
1620	Server.exe
184	Server.exe
1880	Server.exe
3784	Server.exe
5096	Server.exe
3488	Server.exe
3460	Server.exe
5072	Server.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	antivirus by emil v1.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
3392	msedge.exe
3392	msedge.exe
2492	identity_helper.exe
2492	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3736	antivirus by emil v1.0.exe
4540	MicrosoftEdgeUpdater.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe
Token: SeIncBasePriorityPrivilege	4540	MicrosoftEdgeUpdater.exe
Token: 33	4540	MicrosoftEdgeUpdater.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 4540	3736	antivirus by emil v1.0.exe	85
PID 3736 wrote to memory of 4540	3736	antivirus by emil v1.0.exe	85
PID 3736 wrote to memory of 4540	3736	antivirus by emil v1.0.exe	85
PID 4540 wrote to memory of 1220	4540	MicrosoftEdgeUpdater.exe	89
PID 4540 wrote to memory of 1220	4540	MicrosoftEdgeUpdater.exe	89
PID 4540 wrote to memory of 1220	4540	MicrosoftEdgeUpdater.exe	89
PID 4540 wrote to memory of 3392	4540	MicrosoftEdgeUpdater.exe	104
PID 4540 wrote to memory of 3392	4540	MicrosoftEdgeUpdater.exe	104
PID 3392 wrote to memory of 3688	3392	msedge.exe	105
PID 3392 wrote to memory of 3688	3392	msedge.exe	105
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 1776	3392	msedge.exe	106
PID 3392 wrote to memory of 5052	3392	msedge.exe	107
PID 3392 wrote to memory of 5052	3392	msedge.exe	107
PID 3392 wrote to memory of 1428	3392	msedge.exe	108
PID 3392 wrote to memory of 1428	3392	msedge.exe	108
PID 3392 wrote to memory of 1428	3392	msedge.exe	108
PID 3392 wrote to memory of 1428	3392	msedge.exe	108
PID 3392 wrote to memory of 1428	3392	msedge.exe	108
PID 3392 wrote to memory of 1428	3392	msedge.exe	108
PID 3392 wrote to memory of 1428	3392	msedge.exe	108
PID 3392 wrote to memory of 1428	3392	msedge.exe	108
PID 3392 wrote to memory of 1428	3392	msedge.exe	108
PID 3392 wrote to memory of 1428	3392	msedge.exe	108
PID 3392 wrote to memory of 1428	3392	msedge.exe	108
PID 3392 wrote to memory of 1428	3392	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\antivirus by emil v1.0.exe
"C:\Users\Admin\AppData\Local\Temp\antivirus by emil v1.0.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdater.exe
  "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdater.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://meatspin.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb420646f8,0x7ffb42064708,0x7ffb42064718
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,17531251905520387956,5616222979183991632,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
      4⤵
      PID:1776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,17531251905520387956,5616222979183991632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,17531251905520387956,5616222979183991632,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
      4⤵
      PID:1428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17531251905520387956,5616222979183991632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17531251905520387956,5616222979183991632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17531251905520387956,5616222979183991632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17531251905520387956,5616222979183991632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
      4⤵
      PID:3028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,17531251905520387956,5616222979183991632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,17531251905520387956,5616222979183991632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17531251905520387956,5616222979183991632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
      4⤵
      PID:116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17531251905520387956,5616222979183991632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17531251905520387956,5616222979183991632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17531251905520387956,5616222979183991632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
      4⤵
      PID:4804

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2032

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1008

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5048

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4748

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5056

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1896

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2456

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1620

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:184

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1880

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3784

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5096

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3488

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3460

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Server.exe.log

Filesize
507B

MD5
25d1b50e7c0d451f3d850eb54d27ca05

SHA1
a238807715c70a335f54e80d4855644b21a9e870

SHA256
650faa13e983c9046c9030f63a5fa1c33900432ec7cb3762e015da2e7c5b34a5

SHA512
4223a26b2fabefdf1c01443ccc7bd887464d27f02694379895a040c66db472d541218d501f1c01e1bd31012d079a31baf24e20882c32cf652a09a74e3bf385f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
468B

MD5
f9f3a1ef313cda3ef16b630d3104b719

SHA1
7d2538c8ee4d43eaa30815768798e4bb6cc774f1

SHA256
aa92f515114d92748478c119ec1d8e0ce789208ace6fe22eee59ce3c55f0db2d

SHA512
01116bb66cca0e1adb68a4c8e776706715f543ac97ffc68483b67da5a0323860664e161eb0e6adaa16ebfb6a5b81b870c8bf0085c3fb7e10dbe06c55ce88cb05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f506e6ef9b575702a7bd03144e76eb2

SHA1
1f41037f13f9b72187ef304d70390fdabf9ca960

SHA256
6fffa21c702e7a18576f4e91a0d1709b28372d95e5c995ac4e2f1f9a88a30860

SHA512
50738bb9789453f54bd4b30bfcc263eddf287dd95e8a361e055d58889fe9c009c9876494d40514e7c7910a176cca23685c792d42af2302266716066d2410ba1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7c68db0ea3159812af30ccfec8ce5790

SHA1
06e5d3d3ab9e0aa827c02e52ef9c6cc17193d4f4

SHA256
92b3b3e3f50ed94cc7edb412aa27cee4b5ef806e3632cc8f220e0285ca6cf355

SHA512
bcbb852a2986f558059c0821083cb5193a2b5c819206790dd247f03a76d7f5659fee69580eca1d9eceaf70cc1c47010689ee46c68d67afe650ac95f9fd2a1976

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3447ab9d9c8b6726a07918719d76d137

SHA1
bd0de4b2e8f858030c9aa46032c486a2c0c6f66a

SHA256
8dcb0ebdc56d40b15093f3dac80d262183e487a67603a9afdf0f9131e83aa0d5

SHA512
69c263823a9580c8b975830a7cd395015daf8023cfa9bca699d13c8b340c557a27da10a99b5f2f0f16f9481aa751334ae87368644142749ab13be26f5224306a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fa7fd25f2269185ba8411f954517a0f6

SHA1
d8c656826c867cd5e42ebdc07d701a56e6c1dd00

SHA256
f7a6fd40e6119ca09c90d04ad837ac68dd5bdd2e9564d386c4974de5478ba6ae

SHA512
6af8ba222c4e33f3e2f4023c7567812a2f7ca250f70efe899ed8beffdfb8eb2b0c655dc4ef636ff7d9dc81b2e6a7c955256563c4feed2c58213c0a4203305729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
64d78eba73b3f39d4424915ffa16883f

SHA1
e49dee1e05c32cb6417b7347ff7f419ec74a1b82

SHA256
7bc591a6fcf33e946de553ef848b24530806caa95187c9e2299b60c08742d7a6

SHA512
092e4b85400d8506baf7c727e06ecf43bede5e52b2336400d62d7a28bed3025f09757a8bbedcbaa6d2468006bb389efaf8109f6d2a087fe074a0b2e149a95aae

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdater.exe

Filesize
43KB

MD5
04b503df0753a8a4bf74035949215a47

SHA1
fde82e54526910d082a80853730969888d86befd

SHA256
81abb1776a5da5c7844a18f50a4f254eed232c6164b62e2a5fd69d4494c4b943

SHA512
4608a20bfb499bc6a0ca89cab7d080f76f3d7fb2c730492bfa6d7f6301bd50b24af7f228c6a1b5ac06f033c7367fb580279446407bfdad0004669dbdfeb82da2

Download Submit
memory/2508-24-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/2508-25-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/2508-30-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3736-16-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3736-0-0x000000007474E000-0x000000007474F000-memory.dmp

Filesize
4KB

Download
memory/3736-1-0x0000000000320000-0x0000000000332000-memory.dmp

Filesize
72KB

Download
memory/3736-2-0x0000000004CA0000-0x0000000004D3C000-memory.dmp

Filesize
624KB

Download
memory/3736-3-0x0000000005640000-0x0000000005BE4000-memory.dmp

Filesize
5.6MB

Download
memory/3736-4-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3736-5-0x0000000005130000-0x00000000051C2000-memory.dmp

Filesize
584KB

Download
memory/4540-26-0x0000000005970000-0x000000000597A000-memory.dmp

Filesize
40KB

Download
memory/4540-15-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/4540-17-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/4540-20-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/4540-21-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/4540-28-0x0000000006980000-0x0000000006998000-memory.dmp

Filesize
96KB

Download
memory/4540-31-0x0000000005C40000-0x0000000005C4A000-memory.dmp

Filesize
40KB

Download
memory/4540-27-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Filesize
408KB

Download