xenorat | hxxps://github[.]com/Mikeykorby/Educational-Purposes[.]/raw/refs/heads/main/Bootstrapper1[.]exe

Resubmissions

15-02-2025 20:37

250215-zeajaatld1 10

15-02-2025 20:26

250215-y71eqsspck 10

15-02-2025 20:22

250215-y5x7lasqey 10

Analysis

max time kernel
145s
max time network
149s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
15-02-2025 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Mikeykorby/Educational-Purposes./raw/refs/heads/main/Bootstrapper1.exe

Score

10^/10

xenorat discovery rat trojan

Malware Config

Extracted

Family

xenorat

192.168.1.236

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
appdata
port
4785
startup_name
Solara Bootstrapper Dependinces

Signatures

Detect XenoRat Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000500000000fb04-77.dat	family_xenorat
behavioral1/memory/4428-131-0x0000000000A70000-0x0000000000A82000-memory.dmp	family_xenorat

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Xenorat family
xenorat

Downloads MZ/PE file 2 IoCs

flow	pid	Process
60	4196	Process not Found
25	732	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1156831285-1826967968-821913527-1000\Control Panel\International\Geo\Nation	Bootstrapper1.exe

Executes dropped EXE 3 IoCs

pid	Process
4428	Bootstrapper1.exe
3148	Bootstrapper1.exe
1496	Bootstrapper1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
25	raw.githubusercontent.com
13	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2660	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 250459.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\XenoManager\Bootstrapper1.exe\:SmartScreen:$DATA	Bootstrapper1.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5064	schtasks.exe
4384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
732	msedge.exe
732	msedge.exe
640	msedge.exe
640	msedge.exe
4716	identity_helper.exe
4716	identity_helper.exe
2316	msedge.exe
2316	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 4828	640	msedge.exe	85
PID 640 wrote to memory of 4828	640	msedge.exe	85
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 4712	640	msedge.exe	86
PID 640 wrote to memory of 732	640	msedge.exe	87
PID 640 wrote to memory of 732	640	msedge.exe	87
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88
PID 640 wrote to memory of 1128	640	msedge.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Mikeykorby/Educational-Purposes./raw/refs/heads/main/Bootstrapper1.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe68a046f8,0x7ffe68a04708,0x7ffe68a04718
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,19712104806089460,9917330858328293419,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,19712104806089460,9917330858328293419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,19712104806089460,9917330858328293419,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,19712104806089460,9917330858328293419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,19712104806089460,9917330858328293419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,19712104806089460,9917330858328293419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,19712104806089460,9917330858328293419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,19712104806089460,9917330858328293419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,19712104806089460,9917330858328293419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,19712104806089460,9917330858328293419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,19712104806089460,9917330858328293419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,19712104806089460,9917330858328293419,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,19712104806089460,9917330858328293419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2052,19712104806089460,9917330858328293419,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,19712104806089460,9917330858328293419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,19712104806089460,9917330858328293419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2316
- C:\Users\Admin\Downloads\Bootstrapper1.exe
  "C:\Users\Admin\Downloads\Bootstrapper1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:4428
- - C:\Users\Admin\AppData\Roaming\XenoManager\Bootstrapper1.exe
    "C:\Users\Admin\AppData\Roaming\XenoManager\Bootstrapper1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3148
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "Solara Bootstrapper Dependinces" /XML "C:\Users\Admin\AppData\Local\Temp\tmp50EA.tmp" /F
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5064
- C:\Users\Admin\Downloads\Bootstrapper1.exe
  "C:\Users\Admin\Downloads\Bootstrapper1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1496
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "Solara Bootstrapper Dependinces" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7F9B.tmp" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,19712104806089460,9917330858328293419,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEY2MEE3NjMtNkVFMC00Q0Q4LTk5NTItNTE0QTZEMEJBQTM5fSIgdXNlcmlkPSJ7OTc3MTkyMzctMDQ1Mi00QTc4LTk0NTktODJDQUYyQkRGNkMxfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QjgxMjJGRjQtNzYyNi00MkY4LTkzQzYtRTRGQTI4RUVDRkFFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNCIgaW5zdGFsbGRhdGV0aW1lPSIxNzM5MjcwNjA3IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODM3NDE5NDk1ODEwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTIyNTc3MTA1OCIvPjwvYXBwPjwvcmVxdWVzdD4
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Bootstrapper1.exe.log

Filesize
226B

MD5
66aea5e724c4a224d092067c3381783b

SHA1
ee3cc64c4370a255391bdfeef2883d5b7a6e6230

SHA256
04b17cab961f973464bba8924f764edef6451d1774f2405d27ef33d164296923

SHA512
5d719e303f491d1443cb7c7e8946481e90532522a422c98f82466e1eddcd1ef24a4505dcbf75f2191fbb66825d3550566d7f408a3854edeb4c1a192c8c9a6d06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5513dfb49ea99e93ce3c9dbcbb9c2a3f

SHA1
ef10ffc03da5c3cba8bd0951fe75b58d88f09c99

SHA256
d17ae54cbe670febb93df37b8812e2a95d7dd20ceac01a8f2d39360a7b3264af

SHA512
2cbff7b632d1ed99a5c08cd78ef0d9b3842e8709b03050d8571b78d226baa539d8e90eda5da7de6402d6ccd3a8eca37448e84f8b37c2429022b38eed99c7746a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
261B

MD5
2c2e6472d05e3832905f0ad4a04d21c3

SHA1
007edbf35759af62a5b847ab09055e7d9b86ffcc

SHA256
283d954fa21caa1f3b4aba941b154fab3e626ff27e7b8029f5357872c48cbe03

SHA512
8c4ce1ea02da6ffb7e7041c50528da447d087d9ee3c9f4a8c525d2d856cf48e46f5dd9a1fedd23dd047634e719c8886457f7e7240aa3cc36f1a6216e4c00ee37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0a49fefdda5ae5da991df72e8541ab52

SHA1
908a53c2a2cf163fa12b5994da668ad69966486a

SHA256
485c983bec8aa715cb1dfcdeea63cfb5739f50281ad80f215d07933ed1e0bea3

SHA512
6c6008a65b6722b1712b3568d85e0855763b360b86346e7b0918d156319536821418508bb99e822413d11c7fc781bd2f5380fc064f74d463c0eb6ccdda4322c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
129d0a56b9679434e59dae255ca1dfa8

SHA1
06daea34bb5eba350cad69184c05de9bb95b8c25

SHA256
158be6fec4fa212fbad45d4f71a344b4d9468c5ca0e7a2feaef3f79a0ff27c63

SHA512
8ae19107ec973ea47844a27fd2a47e2e6e48f823d9b8dd1fdc49ee9ad31499a00e156e571380cec16b981c658d623b737881c1a39187319662865851a20fd8f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
518c05549a8d994b670f7d2a7220f8f1

SHA1
63a209a913f354995638a83991952fa03663c368

SHA256
e99ec470c76ce8bad725392559a99bd324bc2c122b2a8d9c19e2221f54555854

SHA512
42d93b2bc972fae985fd672e7732a98978707324cc382e9805ea2f6b11f03c4cd95669295930cddf8c5554807a437e8198d174c36abddfd1b54e9cb7631920ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e6dc36bcb07a7d23c8a97c9411a43c25

SHA1
1b68d143b896cd74526a0c7cd6a9a63eea9f81cb

SHA256
9759bba57601a9393803947bc0eceee2a91a04def1b39280e0fec5461e256722

SHA512
0d1659a72791b281f06593e9f82791c6614e9a84621e38211f1773cd043a19b6c34a667928c26f6e2379dd6de63035a121c985a38224d9ee19e291b901a1323a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
74bc01e2b73a0685a34b3dbb13fe7a96

SHA1
631f2c5dd5ec50f4afd6ace8f66d618458a08c6a

SHA256
d9702e33bb475bf2d4bcd5cd5a357e81708443618184a1465542314ac80b242a

SHA512
a0d189bea1762e60053417280c524a2ac738b3f9bfbaf1626a98420a35381b5c405ef46db3d99dd8e9e205de28b9de9e3513aeb30288fad04d5d7b62fde1fe83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2f2659ab0f003d61887ce88a2225fcf8

SHA1
f350f2b7d40b6270c1fbdc9dae97b74502231a5f

SHA256
b1217e6befd920a356219896c16a5d5a67065600a9a7196b93fe09cafd66ba9d

SHA512
58ea587476fda10f26eaa1d6b7938b800ce4710ece7d2b583d152f984479f31e2baf2bb14b906cdce1637e9e8170d6ec4a1898571a2222f9706d891353d02116

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp50EA.tmp

Filesize
1KB

MD5
da6fd436727f3296b91949a5afce90c5

SHA1
0927e56c7c2ee565560adb7b6102de83f76fcb9c

SHA256
47e03c530dc2a0948cb4164e11342e622d8b02fdb4321973957c8d5055cf7367

SHA512
8c4c9163198b90e1d1c53682e59ea506da38b33570cf930b36aeffb47821b1e04ed3b14f6537672d28a0327cf864c856fef5c8db00f6b9f11e994c66a3337c03

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7F9B.tmp

Filesize
1KB

MD5
1ec2f0c6c7965b39b79ca1f79ae490a6

SHA1
5adbb76e1e123c105269819dc073671544c169fe

SHA256
6864bffcab80c29d24c572d759669b314b8ed081ea0ba210658dc863cc797c9e

SHA512
c1b50441ede202d418de4e1915b67f5d000ebc009e2820d0b24d4fe82bd9f4c21061f558191f7bfd5804e0c0cf74f7aa470873c66b975c35a99f461925243ccd

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 250459.crdownload

Filesize
50KB

MD5
5c515c9244bc27f0f426244c885fa70d

SHA1
66e1e6a46113b2bd38b6bb3d1e6325af47229668

SHA256
5636beed6886a348e3d78ed59e335a0f3b798604afb47f966b1b5853568932a3

SHA512
0f91a1dc3777d238b784e1bac7540df01bce101e2eba2b078bb33a4313672ccd6fd1e1b2a3b43befd94a2825807723b718b8198b393f8b72d00dffda2dad66e9

Download Submit
memory/4428-131-0x0000000000A70000-0x0000000000A82000-memory.dmp

Filesize
72KB

Download