Overview

overview

10

Static

static

3

Output.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    556s
  • max time network
    616s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250210-en
  • resource tags

    arch:x64arch:x86image:win11-20250210-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11-02-2025 19:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Output.exe

  • Size

    322KB

  • MD5

    710c071c63a8d8d1cd493c81d34834dc

  • SHA1

    050c535a206ac05550e3670ef465efe83585a76b

  • SHA256

    38944e7579d5fcd2263e7212954619c496d4ff087360b8db6e190e1bdf5358ce

  • SHA512

    af1753c06c22178d1362ab964e445dbe49c5cf3c83ebceabf21b9a7c4cc30efbc66b3a28c4d4f90efba081faba84047edb190d2f05abe416ebf1a1b6c36aad13

  • SSDEEP

    6144:PhPKqm0guLkkFZFjbnSrOsrfUVCmveA3E6Chow8rtryB8YROu+oSxOFDxXMR17:5NnnfZTSHfUV7/E6twurFG+oS4FDxXMP

Score
10/10
umbralxwormadwarediscoveryexecutionpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Family

xworm

C2

147.185.221.19:18254

Attributes
  • Install_directory

    %Temp%

  • install_file

    SecurityHost.exe

  • telegram

    https://api.telegram.org/bot7873282441:AAFVeYQ8VZCC3gF8qlaTYIz4N-gMEL21mHI/sendMessage?chat_id=7952080340

Signatures

  • Detect Umbral payload 2 IoCs
  • Detect Xworm Payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Umbral family
    umbral
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 12 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 36 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Output.exe
    "C:\Users\Admin\AppData\Local\Temp\Output.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:680
    • C:\Users\Admin\AppData\Local\Temp\1.16.5.exe
      "C:\Users\Admin\AppData\Local\Temp\1.16.5.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4404
    • C:\Users\Admin\AppData\Local\Temp\SystemHost.exe
      "C:\Users\Admin\AppData\Local\Temp\SystemHost.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:668
      • C:\Windows\SYSTEM32\attrib.exe
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHost.exe"
        3⤵
        • Views/modifies file attributes
        PID:4344
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SystemHost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1724
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4864
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1852
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4588
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" os get Caption
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4256
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" computersystem get totalphysicalmemory
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4028
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
          PID:2748
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2944
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic" path win32_VideoController get name
          3⤵
          • Detects videocard installed
          PID:3884
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\SystemHost.exe" && pause
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:3868
          • C:\Windows\system32\PING.EXE
            ping localhost
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:680
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTFDOEYyMEUtMzA5My00OUUzLTk1QjYtMUJCOTVGNzc0NjE1fSIgdXNlcmlkPSJ7QTBFRUIzNEMtODU4NS00QjE0LTk2QjYtQjA0QURGMEM2QUQxfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MDBCOEVEQjctMTIwNy00NDE1LUFBNkQtNDc0RTk0MTZBQjM5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjEiIGluc3RhbGxkYXRldGltZT0iMTczOTE4MzcyMyIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNjU1NTQ5Njc0MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxODM5NTQ2NTUiLz48L2FwcD48L3JlcXVlc3Q-
      1⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:932
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{362AB0FE-DC38-48B9-95CC-364303818FA9}\MicrosoftEdge_X64_132.0.2957.140.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{362AB0FE-DC38-48B9-95CC-364303818FA9}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      1⤵
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:4612
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{362AB0FE-DC38-48B9-95CC-364303818FA9}\EDGEMITMP_156D3.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{362AB0FE-DC38-48B9-95CC-364303818FA9}\EDGEMITMP_156D3.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{362AB0FE-DC38-48B9-95CC-364303818FA9}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:364
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{362AB0FE-DC38-48B9-95CC-364303818FA9}\EDGEMITMP_156D3.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{362AB0FE-DC38-48B9-95CC-364303818FA9}\EDGEMITMP_156D3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{362AB0FE-DC38-48B9-95CC-364303818FA9}\EDGEMITMP_156D3.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x240,0x244,0x248,0x23c,0x218,0x7ff7c872a818,0x7ff7c872a824,0x7ff7c872a830
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:2384
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{362AB0FE-DC38-48B9-95CC-364303818FA9}\EDGEMITMP_156D3.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{362AB0FE-DC38-48B9-95CC-364303818FA9}\EDGEMITMP_156D3.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:3256
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{362AB0FE-DC38-48B9-95CC-364303818FA9}\EDGEMITMP_156D3.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{362AB0FE-DC38-48B9-95CC-364303818FA9}\EDGEMITMP_156D3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{362AB0FE-DC38-48B9-95CC-364303818FA9}\EDGEMITMP_156D3.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7c872a818,0x7ff7c872a824,0x7ff7c872a830
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:3872
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5056
          • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff659e5a818,0x7ff659e5a824,0x7ff659e5a830
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:2316
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:2392
          • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff659e5a818,0x7ff659e5a824,0x7ff659e5a830
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:4580
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:1112
          • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff659e5a818,0x7ff659e5a824,0x7ff659e5a830
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:3932
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTFDOEYyMEUtMzA5My00OUUzLTk1QjYtMUJCOTVGNzc0NjE1fSIgdXNlcmlkPSJ7QTBFRUIzNEMtODU4NS00QjE0LTk2QjYtQjA0QURGMEM2QUQxfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsxNjFEQjkxNS1DODczLTRGOTEtQkUzOC0zM0I0QUJBM0ZFM0J9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjQzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMSIgY29ob3J0PSJycmZAMC43MiI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNjYxNSIgcGluZ19mcmVzaG5lc3M9IntGQzJDRUVENC01NjJBLTQyMUQtOTMzNS04NEVGQjU4OEJEQjF9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkwLjAuODE4LjY2IiBuZXh0dmVyc2lvbj0iMTMyLjAuMjk1Ny4xNDAiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMSIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzgzNjYwMTEwNTMxNDQ2MCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTIyOTExMTA4OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjI5MTExMDg5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5NjMyMjUzMjM1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMDc0MDAzNmEtNGUxOC00NTZkLTk2ZmEtZDFkOWM0Y2E0Njc2P1AxPTE3Mzk5MDY3OTAmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9SUMxJTJiM1FFJTJmZGd3OXRRMXdpbHg3WXg0MmtQTHdXalFLdUNZaGZ4YXJxSWI5R3RTb1JTcVBEcHFEWUE4ciUyYkpYUTFiaHhJSE1MTkt2JTJmM0E0SFhxVTFydyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk2MzI0MDk1NjIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzA3NDAwMzZhLTRlMTgtNDU2ZC05NmZhLWQxZDljNGNhNDY3Nj9QMT0xNzM5OTA2NzkwJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUlDMSUyYjNRRSUyZmRndzl0UTF3aWx4N1l4NDJrUEx3V2pRS3VDWWhmeGFycUliOUd0U29SU3FQRHBxRFlBOHIlMmJKWFExYmh4SUhNTE5LdiUyZjNBNEhYcVUxcnclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzcxODAyMTYiIHRvdGFsPSIxNzcxODAyMTYiIGRvd25sb2FkX3RpbWVfbXM9IjQzMzc4MyIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5NjMyNDA5NTYyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk2NDUzNzgzODciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwMTY4OTcyODk0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzY0MSIgZG93bmxvYWRfdGltZV9tcz0iNDQwMzMwIiBkb3dubG9hZGVkPSIxNzcxODAyMTYiIHRvdGFsPSIxNzcxODAyMTYiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjUyMzU5Ii8-PHBpbmcgYWN0aXZlPSIxIiBhPSIxIiByPSIxIiBhZD0iNjYxNSIgcmQ9IjY2MTUiIHBpbmdfZnJlc2huZXNzPSJ7RDAyNTU0NkUtMURCNy00QjU0LUIwQUMtNzc1NzJFMzcxOTY2fSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMzIuMC4yOTU3LjE0MCIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjEiIGNvaG9ydD0icnJmQDAuMjMiIHVwZGF0ZV9jb3VudD0iMSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNjYxNSIgcGluZ19mcmVzaG5lc3M9IntDMEFCRTk2My1EMUQ2LTQ4RUQtQTFBMi03REY3MTM5M0NENEN9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      1⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:1004

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    1
    T1059

    PowerShell

    1
    T1059.001

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Active Setup

    1
    T1547.014

    Browser Extensions

    1
    T1176

    Event Triggered Execution

    1
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Active Setup

    1
    T1547.014

    Event Triggered Execution

    1
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Defense Evasion

    Hide Artifacts

    1
    T1564

    Hidden Files and Directories

    1
    T1564.001

    Modify Registry

    4
    T1112

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Query Registry

    2
    T1012

    Remote System Discovery

    1
    T1018

    System Information Discovery

    2
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    System Network Configuration Discovery

    1
    T1016

    Internet Connection Discovery

    1
    T1016.001

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Web Service

    1
    T1102

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{362AB0FE-DC38-48B9-95CC-364303818FA9}\EDGEMITMP_156D3.tmp\setup.exe
      Filesize

      6.6MB

      MD5

      b4c8ad75087b8634d4f04dc6f92da9aa

      SHA1

      7efaa2472521c79d58c4ef18a258cc573704fb5d

      SHA256

      522a25568bb503cf8b44807661f31f0921dee91d37691bf399868733205690bf

      SHA512

      5094505b33a848badcffd6b3b93aad9ad73f391e201dee052376c4f8573ba351f0b8c102131216088ffb38d0ed7b5fe70ba95c3ac2c33a50c993584fe7c435e3

      Download Submit

    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      Filesize

      3.7MB

      MD5

      3646786aea064c0845f5bb1b8e976985

      SHA1

      a31ba2d2192898d4c0a01511395bdf87b0e53873

      SHA256

      a129a6de7b90500483226192b260eaca1ee116a007771d421aa3eee38af48d6f

      SHA512

      145f8abf2ecffd8ecc3745dbd9ab2e360826fa46d6f21dbebece7802b9b5980f4ab19e2dfd180ce0cfb84366f3ac5c87cd1b74a085e1a0dd620b6c097900e0f4

      Download Submit

    • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
      Filesize

      710KB

      MD5

      37526bd67ec68e44e12b8ff7ee767b36

      SHA1

      d8c48d4dcce3aa4357b791d86c7a210bcdef7890

      SHA256

      1191ab60632a2a68feda28f3246b2c64576e105cbc2e23f3224ca955ae81cf1b

      SHA512

      6dcb49f5af45975b58ace2d62649a1b0238e18bc51c34688574cee1561e25b77d68c5209e14d00abe7c729bbf8a3f2b1a2baae120dc2d2770999c14de4655e6c

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      627073ee3ca9676911bee35548eff2b8

      SHA1

      4c4b68c65e2cab9864b51167d710aa29ebdcff2e

      SHA256

      85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

      SHA512

      3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      2e8eb51096d6f6781456fef7df731d97

      SHA1

      ec2aaf851a618fb43c3d040a13a71997c25bda43

      SHA256

      96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

      SHA512

      0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      948B

      MD5

      4b92d741d003e8d1f0394874017a6fe9

      SHA1

      1a4bebc2637bce160dae38d4d0bfdeb6b398059d

      SHA256

      8c8532230d71f0818daebff0d2ab496b02c25bdaa7156701f663b5474ad876fc

      SHA512

      5c2e84b072314aaae414f98f7dbeb13e030561b53270803d0cf7a8c6ed59368dcfdc4666e69abef39fcac5b75968a1174aca501023297a276a219ed0464612c6

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      7332074ae2b01262736b6fbd9e100dac

      SHA1

      22f992165065107cc9417fa4117240d84414a13c

      SHA256

      baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa

      SHA512

      4ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      8473c0720d50f160d2a0aa6f2c469195

      SHA1

      12178cc31b143c8e205c974340c73f34aeadb1c2

      SHA256

      575c9adfd431e013e5bfb5e133b805ed9e7aa77da05be167f3f8b92211e643b0

      SHA512

      61fe1040a5fbc1c0bf7290bc63b336152831647cafda9d491ae65f927b49fad9d8feb867115eddc8aeab6a8d5c3fd398edde0d177b11180b33982deefd52ceaf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\1.16.5.exe
      Filesize

      80KB

      MD5

      0154c502a44c2d5f9b4d5ccbbb00dd10

      SHA1

      d7e0d7311c345dfd8d9b866d0cc9947da75ef194

      SHA256

      75d7a768d90e198c91aa274d24ff8f08ba95692b888d314aaf6278bb9a175027

      SHA512

      f237bbf5d80712ec3627a618dcd52bb75c379b8e5d3a9f4f10e09cabdb8dfb61a64ec6663b853b607f4add930dd19f249dfdce2b76240820bd3d5cd4ae555e09

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\SystemHost.exe
      Filesize

      231KB

      MD5

      4855e5d98bb0ba10ce6acafaee9a9604

      SHA1

      8ef1a61d89cba2fd51460af7a902150e7066881a

      SHA256

      c51f4e4068a1ad51be55c670091bcddf525e4c3e4a43da4d1c1ab9fe9ac8f1e0

      SHA512

      39240a196a462be0c1fbf45d5d3a755767fef8d89eb4b63bcff30062be746a1237e47cb6fd4d0e980b8786416d5310bff4a40d34d7bcbc447a0c0110a31d3254

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b4ohbjzq.nrr.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Windows\SystemTemp\msedge_installer.log
      Filesize

      72KB

      MD5

      161f807a38a5bd9ca110c321c3a41fb6

      SHA1

      8aef9a4aa47dcad88d6d415b4c7001693d1a059b

      SHA256

      10176a70af86fe889353ba0fa93113b17d0c9ba901833265662581256b44cb96

      SHA512

      c991ee15b8db8a0a7f8fb6c87fc58c7a9149bf2e5ebcd1d0ff17ad0e28ec9666682395a86de38bd53768f88ec16b5e4ab2166570e1e85bd18c1626b57f8a40fa

      Download Submit

    • C:\Windows\SystemTemp\msedge_installer.log
      Filesize

      99KB

      MD5

      e0335a94ba6d56cd04451a5ccdcddb53

      SHA1

      6057bb06449adf1569225a4eb22f7c8da8d047fb

      SHA256

      fcd53fc0ba1f0ade14e0145a0dc65849d02e62740b7882fa31f9a551b83885cc

      SHA512

      5da682622ea3601ad32c963a3688379016673e5fe6dbf48e5d06d9513fa3b42b88c9179f14793344129f20b11629ad17f5f307ffffdc07e92b5a116b1c84c9c9

      Download Submit

    • C:\Windows\SystemTemp\msedge_installer.log
      Filesize

      102KB

      MD5

      44debf6b7dcbb221c430166fe0573969

      SHA1

      a953c6246f284c42158ee34f869c1334d2995bc8

      SHA256

      60a8d2f17daadff6a2b3de4f6da3c1c341a3a8ab7b21812b0a2128cab4f561b7

      SHA512

      6a0deddc3e5593a28ae849434b48c19896e4540b80df0b1fdc01fb64d65f1b630044fd256383a35f67d28786eec8c7e590a68da3881166f75914e99add4a6944

      Download Submit

    • C:\Windows\SystemTemp\msedge_installer.log
      Filesize

      103KB

      MD5

      fe01b023afedfcae552b89c0c67fbf41

      SHA1

      0f891a765e7f2ca6468723392ab61eb326ff9b6f

      SHA256

      2c3e96fea5b6f10b0273c8208e225890b23ce4849220248d37388e302ba34e27

      SHA512

      db2416f7ff34ccf749d10fbd220c571d3a8e3e748d8b54190996ce9271662143aa05d41a8838cfcad4b399e356a1478556d55e7ab727f56eb13dacea6fda31dd

      Download Submit

    • memory/668-55-0x000001E026540000-0x000001E026590000-memory.dmp

      Filesize

      320KB

      Download

    • memory/668-106-0x00007FF85CB10000-0x00007FF85D5D2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/668-25-0x000001E00BCE0000-0x000001E00BD20000-memory.dmp

      Filesize

      256KB

      Download

    • memory/668-87-0x000001E0262F0000-0x000001E0262FA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/668-88-0x000001E026320000-0x000001E026332000-memory.dmp

      Filesize

      72KB

      Download

    • memory/668-54-0x000001E026360000-0x000001E0263D6000-memory.dmp

      Filesize

      472KB

      Download

    • memory/668-102-0x00007FF85CB10000-0x00007FF85D5D2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/668-56-0x000001E026590000-0x000001E0265AE000-memory.dmp

      Filesize

      120KB

      Download

    • memory/668-28-0x00007FF85CB10000-0x00007FF85D5D2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/680-0-0x00007FF85CB13000-0x00007FF85CB15000-memory.dmp

      Filesize

      8KB

      Download

    • memory/680-1-0x0000000000BA0000-0x0000000000BF6000-memory.dmp

      Filesize

      344KB

      Download

    • memory/1724-38-0x000002099EC40000-0x000002099EC62000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4404-29-0x00007FF85CB10000-0x00007FF85D5D2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4404-27-0x00007FF85CB10000-0x00007FF85D5D2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4404-26-0x0000000000060000-0x000000000007A000-memory.dmp

      Filesize

      104KB

      Download