silverrat | edc876045d945c73f2746b87e8aa73415026f6771c114320fefdc5e73828faea

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2025, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

System.Runtime.exe
Size

134KB
MD5

e7621d95185c721aa9e1002703b82fb1
SHA1

187d8a5a6d5244b981e523cce95081055e59150e
SHA256

edc876045d945c73f2746b87e8aa73415026f6771c114320fefdc5e73828faea
SHA512

f2438061ee21db1fd3d82ffbd4064ca1b6c8574d637441f728c5133918b44948647953b91c25795ad0056f74e6f6e15d6349244b122940c6c977a6946fbf0137
SSDEEP

1536:9gAlZHY+5D5YEtSMxuJyxq7J7BmfRNULyvUrTd0E8pXOAIT/Rk0MEMxNGJVuFjvy:9hXYRI3KBms7dwpXOAoRLEfGnDwcPlgY

Score

10^/10

silverrat defense_evasion discovery execution persistence trojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

if-eventually.gl.at.ply.gg:17094

Mutex

lAxDBRhAFu

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
b0FGeVZNcFRMWVloVHR6Z0VESU5RdlpZUmxZbUFE
reconnect_delay
4
server_signature
t9H0tGywaq23QHywsvniYlva2DUEoHwEX4RZOKw6QYOUUUEs6+qPhkwL0ziJc2nYj2yd5E4o3kMJj8NRpRTkpZcyIg/ljsBjIY4uuTgySYNYShSJRrNgQc/XiUXjH546feRdpS3EuZPWH15iNA3U89kmdXU1BOtms28guz5MUZ/jdeGBHbjPJULpyM8EgGGdK3ajqJ+NWQxPHql47XGQFXqJ5PauE0xmpcMKt+LU7fe+NS0Yx11uv+tRwSlMmFhYU9pSYoS8zZ7Lyeaw8rcxs06oecNxLKcmbSH3H5QWo4qYq/Y7HAeBmLEHHB5t8+bCVeDMfccmct8s+aZpljSceGlri2HJsxEjZ7FYmh4+o8bhacTmqQyE99P1kSa4FAWPLn59j5s1nO91Sb/rMvcNUApgatm6ZRZjc+Ninv7rXwFncnT7eRSRvldp7PohX6bsJEJRMnfLT4YxM0TzqV9POSK0hjrRojbiRQWahccxQRKfg3TcVxNnNjCQWMOJ0YzNuQ0ZSTLPO3QA4v/0cwD5nBhPdhowAnMUb4j61HsPdaQnKXvlx377vbMOowWJFqGC1ES1rKn843GMu81HL7FJsfrpqglmmFTddG3IwkeJU7umxj41+anidgCco7Jzbii9D9e4l2DF3EuhYg+qIuiwNw4ACh3olxSGStXl952V/dY=

Signatures

SilverRat
SilverRat is trojan written in C#.
trojan silverrat
Silverrat family
silverrat

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2188	attrib.exe
4220	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation	$77Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation	System.Runtime.exe

Executes dropped EXE 2 IoCs

pid	Process
404	System.Runtime.exe
5964	$77Runtime Broker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\WinTask\\$77Runtime Broker.exe\""	System.Runtime.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3612	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	System.Runtime.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5848	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3916	schtasks.exe
6120	schtasks.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4388	msedge.exe
4388	msedge.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
404	System.Runtime.exe
4648	identity_helper.exe
4648	identity_helper.exe
5964	$77Runtime Broker.exe
5964	$77Runtime Broker.exe
3612	powershell.exe
3612	powershell.exe
3612	powershell.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeBackupPrivilege	4072	vssvc.exe
Token: SeRestorePrivilege	4072	vssvc.exe
Token: SeAuditPrivilege	4072	vssvc.exe
Token: SeDebugPrivilege	404	System.Runtime.exe
Token: SeDebugPrivilege	5964	$77Runtime Broker.exe
Token: SeDebugPrivilege	3612	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5964	$77Runtime Broker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 4388	1696	System.Runtime.exe	89
PID 1696 wrote to memory of 4388	1696	System.Runtime.exe	89
PID 4388 wrote to memory of 2452	4388	msedge.exe	90
PID 4388 wrote to memory of 2452	4388	msedge.exe	90
PID 1696 wrote to memory of 404	1696	System.Runtime.exe	91
PID 1696 wrote to memory of 404	1696	System.Runtime.exe	91
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 3532	4388	msedge.exe	93
PID 4388 wrote to memory of 4600	4388	msedge.exe	94
PID 4388 wrote to memory of 4600	4388	msedge.exe	94
PID 4388 wrote to memory of 2300	4388	msedge.exe	95
PID 4388 wrote to memory of 2300	4388	msedge.exe	95
PID 4388 wrote to memory of 2300	4388	msedge.exe	95
PID 4388 wrote to memory of 2300	4388	msedge.exe	95
PID 4388 wrote to memory of 2300	4388	msedge.exe	95
PID 4388 wrote to memory of 2300	4388	msedge.exe	95
PID 4388 wrote to memory of 2300	4388	msedge.exe	95
PID 4388 wrote to memory of 2300	4388	msedge.exe	95
PID 4388 wrote to memory of 2300	4388	msedge.exe	95
PID 4388 wrote to memory of 2300	4388	msedge.exe	95
PID 4388 wrote to memory of 2300	4388	msedge.exe	95
PID 4388 wrote to memory of 2300	4388	msedge.exe	95
PID 4388 wrote to memory of 2300	4388	msedge.exe	95
PID 4388 wrote to memory of 2300	4388	msedge.exe	95
PID 4388 wrote to memory of 2300	4388	msedge.exe	95
PID 4388 wrote to memory of 2300	4388	msedge.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2188	attrib.exe
4220	attrib.exe

C:\Users\Admin\AppData\Local\Temp\System.Runtime.exe
"C:\Users\Admin\AppData\Local\Temp\System.Runtime.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.rustemsoft.com/SkaterTOTAL.asp
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff248e46f8,0x7fff248e4708,0x7fff248e4718
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3192196072405401204,18342472067323520160,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1844 /prefetch:2
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,3192196072405401204,18342472067323520160,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,3192196072405401204,18342472067323520160,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3192196072405401204,18342472067323520160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3192196072405401204,18342472067323520160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,3192196072405401204,18342472067323520160,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,3192196072405401204,18342472067323520160,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3192196072405401204,18342472067323520160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
    3⤵
    PID:1412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3192196072405401204,18342472067323520160,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3192196072405401204,18342472067323520160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3192196072405401204,18342472067323520160,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3192196072405401204,18342472067323520160,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5484 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6036
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\{FEF10DED-355E-4e06-9381-9B24D7F7CC88}.{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}\System.Runtime.exe
  C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\{FEF10DED-355E-4e06-9381-9B24D7F7CC88}.{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}\System.Runtime.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:404
- - C:\Windows\System32\attrib.exe
    "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2188
- - C:\Windows\System32\attrib.exe
    "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask\$77Runtime Broker.exe"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:4220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3AA3.tmp.bat""
    3⤵
    PID:5796
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:5848
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask\$77Runtime Broker.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask\$77Runtime Broker.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5964
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks.exe" /query /TN $77Runtime Broker.exe
        5⤵
        
        PID:6072
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks.exe" /Create /SC ONCE /TN "$77Runtime Broker.exe" /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask\$77Runtime Broker.exe \"\$77Runtime Broker.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6120
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks.exe" /query /TN $77Runtime Broker.exe
        5⤵
        
        PID:3024
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3612
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc hourly /mo 1 /tn "Runtime Broker_Task-HOURLY-01" /tr "%MyFile%" /st 00:00
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3660

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e27df0383d108b2d6cd975d1b42b1afe

SHA1
c216daa71094da3ffa15c787c41b0bc7b32ed40b

SHA256
812f547f1e22a4bd045b73ff548025fabd59c6cba0da6991fdd8cfcb32653855

SHA512
471935e26a55d26449e48d4c38933ab8c369a92d8f24fd6077131247e8d116d95aa110dd424fa6095176a6c763a6271e978766e74d8022e9cdcc11e6355408ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
395082c6d7ec10a326236e60b79602f2

SHA1
203db9756fc9f65a0181ac49bca7f0e7e4edfb5b

SHA256
b9ea226a0a67039df83a9652b42bb7b0cc2e6fa827d55d043bc36dd9d8e4cd25

SHA512
7095c260b87a0e31ddfc5ddf5730848433dcede2672ca71091efb8c6b1b0fc3333d0540c3ce41087702c99bca22a4548f12692234188e6f457c2f75ab12316bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
88c0420000a27709eda9bcdb98b1a814

SHA1
64a7dcc0ae9083d26fd05edbec6fd784a0d650a5

SHA256
725289825f79bb2758d60b8a0faed1a1ab5b60f1eedfd5010014cc7da66ad99c

SHA512
1862bf72a72e7da09b5bb666f7f8e72cbaffc6148216c68e36f0e062dbae3cb2d9d5a013b844b67ed2a8a285e3ece2741d6cd085235f9084a57185c626b41599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a7e7694d-e595-4870-bbb4-a113000f880b.tmp

Filesize
6KB

MD5
d86776c99408f27d5624ee7beeee056c

SHA1
383c241975cf5602470d270e1da2f284d634062c

SHA256
6c9e4f01a08805fb90bdb6944ca7837b7947310239385f7b1ec4c5831f923309

SHA512
a154b9daff433890bfc1c48d24a0fcb9d907e3bade3b35dab683aa23d705f413b2c54455f20a00b316d74c38f3f79a6da7b068f3187522a42d4805d75a92ee8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
02518016b2df8be10a26ee7766905b3d

SHA1
cae0cc7800fbb99621c236b54ac90ef30c3835f4

SHA256
28eb6f8d096a736373b13af3c1d282d817b60afbfdf9b97fac840ba042821026

SHA512
dd873e797e0c94209c7618af5c3467466500f19d730a1b1be1964ec982d746b4cdf25662deb3bbeddc0fcfccc1bc4b8dc51ebbd72cec25d10467b9d5df944d53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\{FEF10DED-355E-4e06-9381-9B24D7F7CC88}.{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}\System.Runtime.exe

Filesize
43KB

MD5
3c7e3574e6e56d2e7a2e2c2f78555491

SHA1
cef927a96eeb7055e13d720be16773ac2407038e

SHA256
7a30e605cf7a26c63af96185710452c1ec812849a0366f6a008f0dcde815c156

SHA512
8d729a9853bc88f20902a79ca4cabb3d7f69ce1fd8335e0f82c6fb1ec3f6a3141f308c6d341f785a4b72fe053c6a0d0804b22893c40d6de66236dbdea9a53b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\{FEF10DED-355E-4e06-938l-9B2407F7CC88}.{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}\System.Runtime.exe

Filesize
43KB

MD5
eda12f565de784f92e5da5179bee6d26

SHA1
ae24f45b65a858604a9562eb0fcdf244e87744bd

SHA256
535d712f97deb16cbf71dfe80e91890410244bb71e3e48ef33a941eb9f89ae6c

SHA512
a75bf53ad2740fe0230b1c9b50985bd64f72ea3abd5b077dc6d0096dfbee8b2ab95019832826eff0825979ba8a82c433290307c8945e23efb9881f766cafdaba

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ho1kwq3b.ho5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3AA3.tmp.bat

Filesize
197B

MD5
b0a8b3c86f2c1d062c3f0570bf7700c6

SHA1
af27c5cb4e8d622408f05fda4955f466c8fe4b3e

SHA256
8d2c3c2e9d069bc67cee6b4e8a725816c696246fcc8dcc152dde587861600816

SHA512
642cb0624aa28ca5ce3de3afef5489bea65640102c20e4d4d3b729ba9e7ec887c5491afeb02ac06bba9afbffe635275aa068bdd56617e6f5c6ef2d2ed3b8bc50

Download Submit
memory/404-84-0x00007FFF23C33000-0x00007FFF23C35000-memory.dmp

Filesize
8KB

Download
memory/404-90-0x00007FFF23C30000-0x00007FFF246F1000-memory.dmp

Filesize
10.8MB

Download
memory/404-41-0x00007FFF23C30000-0x00007FFF246F1000-memory.dmp

Filesize
10.8MB

Download
memory/404-35-0x00007FFF23C33000-0x00007FFF23C35000-memory.dmp

Filesize
8KB

Download
memory/404-105-0x00007FFF23C30000-0x00007FFF246F1000-memory.dmp

Filesize
10.8MB

Download
memory/404-34-0x0000000000B00000-0x0000000000B12000-memory.dmp

Filesize
72KB

Download
memory/3612-135-0x0000020EC4800000-0x0000020EC4822000-memory.dmp

Filesize
136KB

Download