xred | 6f513f4b91acba47885d8b61e4da53eb233305956f18be998a5d56048e9c400c

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2025 18:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vnhax_new.exe
Size

7.0MB
MD5

1cfc313319188c7db6f2e77675101e7a
SHA1

d63cdf56928e870868867032bfb09550f2315dfc
SHA256

3dc0a471eebb84b66dc17e71c00ab6c70541237a870fbba297e3436053c55c66
SHA512

9d250f9d57ca2fd2d2da40f2f505562e5ed5fad502959f50de02053129152a05a86c6b57d50abf40c404b3c95d12ae53fe8612b65e390eb1f01e845d53611997
SSDEEP

196608:HLxlFP7GIFourQ6CJQbHdK3lgz8UXiU/0V:H9lFzJoNi94Uo

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Vnhax_new.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	._cache_Vnhax_new.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Setup280.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Setup280.exe

Executes dropped EXE 7 IoCs

pid	Process
3096	._cache_Vnhax_new.exe
2284	Synaptics.exe
1576	Setup280.exe
2364	._cache_Synaptics.exe
4772	._cache_Setup280.exe
4064	Setup280.exe
4052	._cache_Setup280.exe

Loads dropped DLL 2 IoCs

pid	Process
4064	Setup280.exe
4064	Setup280.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	Vnhax_new.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Setup280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Setup280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vnhax_new.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Vnhax_new.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Vnhax_new.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Setup280.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Setup280.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4636	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe
2396	msedge.exe
2396	msedge.exe
5140	identity_helper.exe
5140	identity_helper.exe
5292	msedge.exe
5292	msedge.exe
5292	msedge.exe
5292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4052	._cache_Setup280.exe
Token: SeDebugPrivilege	4772	._cache_Setup280.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4636	EXCEL.EXE
4636	EXCEL.EXE
4636	EXCEL.EXE
4636	EXCEL.EXE
4636	EXCEL.EXE
4636	EXCEL.EXE
4636	EXCEL.EXE
4636	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3096	4816	Vnhax_new.exe	83
PID 4816 wrote to memory of 3096	4816	Vnhax_new.exe	83
PID 4816 wrote to memory of 3096	4816	Vnhax_new.exe	83
PID 4816 wrote to memory of 2284	4816	Vnhax_new.exe	84
PID 4816 wrote to memory of 2284	4816	Vnhax_new.exe	84
PID 4816 wrote to memory of 2284	4816	Vnhax_new.exe	84
PID 3096 wrote to memory of 1576	3096	._cache_Vnhax_new.exe	85
PID 3096 wrote to memory of 1576	3096	._cache_Vnhax_new.exe	85
PID 3096 wrote to memory of 1576	3096	._cache_Vnhax_new.exe	85
PID 2284 wrote to memory of 2364	2284	Synaptics.exe	87
PID 2284 wrote to memory of 2364	2284	Synaptics.exe	87
PID 2284 wrote to memory of 2364	2284	Synaptics.exe	87
PID 1576 wrote to memory of 4772	1576	Setup280.exe	89
PID 1576 wrote to memory of 4772	1576	Setup280.exe	89
PID 1576 wrote to memory of 4772	1576	Setup280.exe	89
PID 2364 wrote to memory of 4064	2364	._cache_Synaptics.exe	90
PID 2364 wrote to memory of 4064	2364	._cache_Synaptics.exe	90
PID 2364 wrote to memory of 4064	2364	._cache_Synaptics.exe	90
PID 4064 wrote to memory of 4052	4064	Setup280.exe	92
PID 4064 wrote to memory of 4052	4064	Setup280.exe	92
PID 4064 wrote to memory of 4052	4064	Setup280.exe	92
PID 4052 wrote to memory of 2396	4052	._cache_Setup280.exe	97
PID 4052 wrote to memory of 2396	4052	._cache_Setup280.exe	97
PID 2396 wrote to memory of 3916	2396	msedge.exe	98
PID 2396 wrote to memory of 3916	2396	msedge.exe	98
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99
PID 2396 wrote to memory of 4368	2396	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\Vnhax_new.exe
"C:\Users\Admin\AppData\Local\Temp\Vnhax_new.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\._cache_Vnhax_new.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_Vnhax_new.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Users\Admin\AppData\Local\Temp\Setup280.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup280.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Setup280.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Setup280.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.vnhax.net/p/gflhfdokln.html
        5⤵
        
        PID:5872
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa04a746f8,0x7ffa04a74708,0x7ffa04a74718
        6⤵
        
        PID:5896
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Setup280.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup280.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\._cache_Setup280.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Setup280.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4052
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.vnhax.net/p/gflhfdokln.html
        6⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa04a746f8,0x7ffa04a74708,0x7ffa04a74718
        7⤵
        
        PID:3916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
        7⤵
        
        PID:4368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
        7⤵
        
        PID:2904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
        7⤵
        
        PID:1208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
        7⤵
        
        PID:3832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
        7⤵
        
        PID:2832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
        7⤵
        
        PID:2056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
        7⤵
        
        PID:5048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
        7⤵
        
        PID:228
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
        7⤵
        
        PID:4432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
        7⤵
        
        PID:4868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
        7⤵
        
        PID:5352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
        7⤵
        
        PID:5360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
        7⤵
        
        PID:5948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
        7⤵
        
        PID:4868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
        7⤵
        
        PID:5312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,12992269639630078157,13649536234775769635,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5292

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
7.0MB

MD5
1cfc313319188c7db6f2e77675101e7a

SHA1
d63cdf56928e870868867032bfb09550f2315dfc

SHA256
3dc0a471eebb84b66dc17e71c00ab6c70541237a870fbba297e3436053c55c66

SHA512
9d250f9d57ca2fd2d2da40f2f505562e5ed5fad502959f50de02053129152a05a86c6b57d50abf40c404b3c95d12ae53fe8612b65e390eb1f01e845d53611997

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
679271836dce9db155d5237585e4c350

SHA1
8a92d0125605ccbd01773bd35cb3742a16ca5aec

SHA256
889462513d46529fb245e3b57ac6ffa4fe7f43a4a48bcb54fc33a606f8a8b1f7

SHA512
32e660cf66fed8fc0c5adf04bc86dfdb720cb5e7d21d85045ba26f9e50cf6803a93601bb71e5fb8a55b070defed86d9046cc43bd66181934e6d4faee49dfcacd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bae7268576b440d0d51d1893e7cd4da7

SHA1
6921349d188d33cb967a95145011596bd9c1505e

SHA256
4bf40911e355f835d69a3a7c19cc04255a05173578f28a87ee30c839a530d5ed

SHA512
106d21be1d24c46b195ce7fdb9e913562eb94cc968f495cd9901d2f3ad3ebc6c619db6cbb5d26a1c4dc8fe3b60cc4ecb823b95de2939f07dedbf9befa6c1e1d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e6c6e913c511f1a142f5ab67e93ffea

SHA1
9a53367f03321912094bb7e4170613159f9854d4

SHA256
6bb1d8d6c086acdc5a56c5c5932248bff86b550ba7fc68245dfc8938c6d97ea5

SHA512
09c76fb6fa93b35883f4c67540e19b509ee3c0e57e7bac82eb647b967ea26d2aec8e8b4fc1df5853e2b928aac88cdbc061564a80437fcec01d4bb432854d10dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8e2b257b413fa547b91ce0a2975315a7

SHA1
5512bb06581febe65f4e494807a4f403fca31396

SHA256
0c2857ea558c36531ab45320d09157ccaf1b1a08fe134c3965c1ffaa680e0e22

SHA512
5993fa1ff4ff6d8bd9e2dce7ef9d00739573163e6332dc3df1c36574bd8976991477414c5d6ef00c7c4c6de76fa09fdd7f009cee8182af1972a1224f44460060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fc8ef59844ac83b0fa5e51978abcbfd9

SHA1
8f2fcfb4b2cda5a0fc8a2789a25936e2060a2bda

SHA256
5238e1bfc9d5be726db3e91f4786c20319f419982003bdc8d6d74eeb5f6c2834

SHA512
e8fbfe0256a0e352affc5e5879081f2536c2d19ecfa1a970beef0c6a135224bd9d0d017ce5dd25fcc671feb1ddde3bb45d602357c05bd8003e58d451cfc74c49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
94d2e9a33a8c53e5d760b0f2528bf59a

SHA1
28629dc371234ca106cd60c9fc3cff364123f8cb

SHA256
39b9a86afd66d9a323f51a2eec5b83da6cb1aa76589ded574289d110ec08bde1

SHA512
4b259ef1aa194930f7b2fbfdd47bdd3922a56fac629bb2188581fd71a55e9b3dbf228bbd925e545f2f35d8ba4b5f8a47aa8cb3134a7bc72cf275b02cc9a45ce7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Filesize
2KB

MD5
c54761082bdf20290a64d3da0ba53bdf

SHA1
873382ffe63fa9d1846f2a5919d1007011895c96

SHA256
4dee5ba8cfbac0f88c21bf8e155cfe29af5c7f5522ef540f5f81cd877a211772

SHA512
5bd2ea66a872b86aeb925b0feaf83ead7aa2e26ce330678abf9e8f3597998d353a15eb1d19d5854db13dae189eb6ba27ca51fc27485139a80c192498b92d2239

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_Setup280.exe

Filesize
180KB

MD5
787b77ed4a3970d0565f1e22e3e72065

SHA1
c396438b5cce7729e756c53c5b43a2af63cdd6a1

SHA256
467c4a87b06cd1f0c71f0a912551e51bae533875f5b831afa6cba06dfaa53c8b

SHA512
6a74cdd984810202c6e532d2ba0121e12803844399fcb07af7f697c7b00fcde6013a764bd8e954dbb7d3713a1448929d1e2a08785635a3e52ef2db79b96958be

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_Vnhax_new.exe

Filesize
6.2MB

MD5
7e252e1a74bda7c621c9c45b9bff2df9

SHA1
f06c87842777d1cd9f5e0c2bb5ec3ffc0807f545

SHA256
21e920cf6b6741aea46a5548c4ddffc1ad079c834cc46e81dc091720eb3c4325

SHA512
69baefaf7ed0349ef50245d16f90255f2d00abbe253ccb001b0098243a38bb4fecabe14f90b8334e3bec9351dfe73726f0d7edb352ddb00fb671d01d9375c8a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\88C75E00

Filesize
23KB

MD5
392ba9a43884077787bc5a2813491330

SHA1
f84024dbafde9cbd34f0b3071fdf4a4bfd89c6b9

SHA256
5116a49d87d8c79fb45f1fc8dcaa5dc8b4f5b6de165709422270b5cdf862a834

SHA512
2c2d21d4045277f3d2921455a522eb1aa099838648814eb560f45baaffb6b7e5cd9547e270bdaa5b48c9d380c139d30b6f7529d37abd93153c98f6daa1d19092

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup280.exe

Filesize
933KB

MD5
fd1247e7caf911c86f9a3ec6743d0ff8

SHA1
c43c2501f18b1454e2daef94f27bcfaf287b8023

SHA256
18f89cedbb9a651d268bbef4472575e026df00aa3625cfb98a2091e7791b8a44

SHA512
76bcd728a116b8784fd3a46c9f5c10bddbb45410ebfa7ff615b8b1c8ebb192a54b90f60abc28f3b167741f637be6d9aebf8e34666edbeae283cd8df2751ddac8

Download Submit
C:\Users\Admin\AppData\Local\Temp\pNW6azmz.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
memory/1576-216-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2284-332-0x0000000000400000-0x0000000000AFE000-memory.dmp

Filesize
7.0MB

Download
memory/2284-453-0x0000000000400000-0x0000000000AFE000-memory.dmp

Filesize
7.0MB

Download
memory/4064-231-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/4636-215-0x00007FF9E2050000-0x00007FF9E2060000-memory.dmp

Filesize
64KB

Download
memory/4636-217-0x00007FF9DFFC0000-0x00007FF9DFFD0000-memory.dmp

Filesize
64KB

Download
memory/4636-211-0x00007FF9E2050000-0x00007FF9E2060000-memory.dmp

Filesize
64KB

Download
memory/4636-214-0x00007FF9E2050000-0x00007FF9E2060000-memory.dmp

Filesize
64KB

Download
memory/4636-223-0x00007FF9DFFC0000-0x00007FF9DFFD0000-memory.dmp

Filesize
64KB

Download
memory/4636-213-0x00007FF9E2050000-0x00007FF9E2060000-memory.dmp

Filesize
64KB

Download
memory/4636-212-0x00007FF9E2050000-0x00007FF9E2060000-memory.dmp

Filesize
64KB

Download
memory/4772-226-0x00000000058C0000-0x00000000058CA000-memory.dmp

Filesize
40KB

Download
memory/4772-219-0x0000000000F10000-0x0000000000F46000-memory.dmp

Filesize
216KB

Download
memory/4772-220-0x0000000001710000-0x0000000001720000-memory.dmp

Filesize
64KB

Download
memory/4772-224-0x000000000A2B0000-0x000000000A854000-memory.dmp

Filesize
5.6MB

Download
memory/4772-225-0x0000000005920000-0x00000000059B2000-memory.dmp

Filesize
584KB

Download
memory/4816-0-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/4816-101-0x0000000000400000-0x0000000000AFE000-memory.dmp

Filesize
7.0MB

Download