raccoon | c3193806a082fa6c5c4b755e343c01dcf9169487acbf9150ab169d3972a8c6e8

Target

Microsoft_Toolkit.exe
Size

4.9MB
MD5

ee287c2e51854fee07881638379c6f38
SHA1

1dccecc235b6d702a8fea3350c72b9c52c05c7be
SHA256

c3193806a082fa6c5c4b755e343c01dcf9169487acbf9150ab169d3972a8c6e8
SHA512

02a1e9874f994e958489be409e3a6efcce642c57b9f5e50de0a2072ad15769cdb717744ed37436b0f9d94104572a79d39e6114938ba3e5a6670d6c05e780aafa

Score

10^/10

raccoon smokeloader backdoor bootkit discovery evasion persistence spyware stealer trojan upx

Malware Config

Extracted

Family

smokeloader

Version

2020

http://oversun.monster/upload/

http://oversun.net/upload/

http://dingobossin.com/upload/

http://duda1.monster/upload/

http�//vinder55.monster/upload/

http://jamb2.monster/upload/

rc4.i32

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 15 IoCs

Processes:

KRSetp.exejg7_7wjg.exeproz.exeubisoftant.exeaskinstall4.exepiyyy.exeupdate_5e6d00.exesetup.exePas.exejfiag3g_gg.exe7279391.80226943.2Windows Host.exejfiag3g_gg.exe1B88.exe

pid	process
3744	KRSetp.exe
756	jg7_7wjg.exe
644	proz.exe
3316	ubisoftant.exe
4396	askinstall4.exe
3380	piyyy.exe
4296	update_5e6d00.exe
4272	setup.exe
1184	Pas.exe
4492	jfiag3g_gg.exe
4304	7279391.80
4312	226943.2
1332	Windows Host.exe
4848	jfiag3g_gg.exe
540	1B88.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\update_5e6d00.exe	upx
C:\Users\Admin\AppData\Local\Temp\update_5e6d00.exe	upx
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pas.exe	upx
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pas.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\1B88.exe	upx
C:\Users\Admin\AppData\Local\Temp\1B88.exe	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Microsoft_Toolkit.exeproz.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation	Microsoft_Toolkit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation	proz.exe

Loads dropped DLL 7 IoCs

Processes:

update_5e6d00.exePas.exe

pid process

4296 update_5e6d00.exe
1184 Pas.exe
1184 Pas.exe
1184 Pas.exe
1184 Pas.exe
1184 Pas.exe
1184 Pas.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

piyyy.exe226943.2

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.ex"	piyyy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe"	226943.2

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

jg7_7wjg.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg7_7wjg.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg7_7wjg.exe

JavaScript code in executable 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\nss3.dll	js

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 ip-api.com
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

1B88.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 1B88.exe
Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe

flow	ioc
12	ip-api.com

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	1B88.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

update_5e6d00.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	update_5e6d00.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	update_5e6d00.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	update_5e6d00.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2156 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4488 taskkill.exe
Modifies Control Panel 1 IoCs
evasion

Processes:

MicrosoftEdge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Colors MicrosoftEdge.exe

pid	process
2156	timeout.exe

pid	process
4488	taskkill.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Colors	MicrosoftEdge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe

Modifies registry class 215 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompleted = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b135403bb4ecd601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

askinstall4.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	askinstall4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	askinstall4.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2504 PING.EXE

pid	process
2504	PING.EXE

Suspicious behavior: EnumeratesProcesses 733 IoCs

Processes:

update_5e6d00.exejfiag3g_gg.exe7279391.80

pid	process
4296	update_5e6d00.exe
4296	update_5e6d00.exe
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
4848	jfiag3g_gg.exe
4848	jfiag3g_gg.exe
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
3152
4304	7279391.80
4304	7279391.80
3152
3152
4304	7279391.80
3152
3152
3152
3152
3152
3152
3152

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

update_5e6d00.exeMicrosoftEdgeCP.exe

pid process

4296 update_5e6d00.exe
2228 MicrosoftEdgeCP.exe
2228 MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

Processes:

KRSetp.exetaskkill.exe7279391.80ubisoftant.exejg7_7wjg.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe1B88.exe

description	pid	process
Token: SeDebugPrivilege	3744	KRSetp.exe
Token: SeDebugPrivilege	4488	taskkill.exe
Token: SeDebugPrivilege	4304	7279391.80
Token: SeManageVolumePrivilege	3316	ubisoftant.exe
Token: SeManageVolumePrivilege	756	jg7_7wjg.exe
Token: SeDebugPrivilege	2192	MicrosoftEdge.exe
Token: SeDebugPrivilege	2192	MicrosoftEdge.exe
Token: SeDebugPrivilege	2192	MicrosoftEdge.exe
Token: SeDebugPrivilege	2192	MicrosoftEdge.exe
Token: SeShutdownPrivilege	3152
Token: SeCreatePagefilePrivilege	3152
Token: SeShutdownPrivilege	3152
Token: SeCreatePagefilePrivilege	3152
Token: SeShutdownPrivilege	3152
Token: SeCreatePagefilePrivilege	3152
Token: SeShutdownPrivilege	3152
Token: SeCreatePagefilePrivilege	3152
Token: SeShutdownPrivilege	3152
Token: SeCreatePagefilePrivilege	3152
Token: SeDebugPrivilege	224	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	224	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	224	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	224	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	3152
Token: SeCreatePagefilePrivilege	3152
Token: SeShutdownPrivilege	3152
Token: SeCreatePagefilePrivilege	3152
Token: SeShutdownPrivilege	3152
Token: SeCreatePagefilePrivilege	3152
Token: SeManageVolumePrivilege	756	jg7_7wjg.exe
Token: SeShutdownPrivilege	3152
Token: SeCreatePagefilePrivilege	3152
Token: SeDebugPrivilege	1180	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1180	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	3152
Token: SeCreatePagefilePrivilege	3152
Token: SeShutdownPrivilege	3152
Token: SeCreatePagefilePrivilege	3152
Token: SeShutdownPrivilege	3152
Token: SeCreatePagefilePrivilege	3152
Token: SeShutdownPrivilege	3152
Token: SeCreatePagefilePrivilege	3152
Token: SeShutdownPrivilege	3152
Token: SeCreatePagefilePrivilege	3152
Token: SeShutdownPrivilege	3152
Token: SeCreatePagefilePrivilege	3152
Token: SeShutdownPrivilege	540	1B88.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

ubisoftant.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

3316 ubisoftant.exe
3316 ubisoftant.exe
2192 MicrosoftEdge.exe
2228 MicrosoftEdgeCP.exe
2228 MicrosoftEdgeCP.exe

pid	process
3316	ubisoftant.exe
3316	ubisoftant.exe
2192	MicrosoftEdge.exe
2228	MicrosoftEdgeCP.exe
2228	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 70 IoCs

Processes:

Microsoft_Toolkit.exesetup.exeproz.execmd.exepiyyy.exeKRSetp.exeaskinstall4.execmd.exe226943.2MicrosoftEdgeCP.exePas.execmd.exe

description	pid	process	target process
PID 4804 wrote to memory of 3744	4804	Microsoft_Toolkit.exe	KRSetp.exe
PID 4804 wrote to memory of 3744	4804	Microsoft_Toolkit.exe	KRSetp.exe
PID 4804 wrote to memory of 756	4804	Microsoft_Toolkit.exe	jg7_7wjg.exe
PID 4804 wrote to memory of 756	4804	Microsoft_Toolkit.exe	jg7_7wjg.exe
PID 4804 wrote to memory of 756	4804	Microsoft_Toolkit.exe	jg7_7wjg.exe
PID 4804 wrote to memory of 644	4804	Microsoft_Toolkit.exe	proz.exe
PID 4804 wrote to memory of 644	4804	Microsoft_Toolkit.exe	proz.exe
PID 4804 wrote to memory of 644	4804	Microsoft_Toolkit.exe	proz.exe
PID 4804 wrote to memory of 3316	4804	Microsoft_Toolkit.exe	ubisoftant.exe
PID 4804 wrote to memory of 3316	4804	Microsoft_Toolkit.exe	ubisoftant.exe
PID 4804 wrote to memory of 3316	4804	Microsoft_Toolkit.exe	ubisoftant.exe
PID 4804 wrote to memory of 4396	4804	Microsoft_Toolkit.exe	askinstall4.exe
PID 4804 wrote to memory of 4396	4804	Microsoft_Toolkit.exe	askinstall4.exe
PID 4804 wrote to memory of 4396	4804	Microsoft_Toolkit.exe	askinstall4.exe
PID 4804 wrote to memory of 3380	4804	Microsoft_Toolkit.exe	piyyy.exe
PID 4804 wrote to memory of 3380	4804	Microsoft_Toolkit.exe	piyyy.exe
PID 4804 wrote to memory of 3380	4804	Microsoft_Toolkit.exe	piyyy.exe
PID 4804 wrote to memory of 4296	4804	Microsoft_Toolkit.exe	update_5e6d00.exe
PID 4804 wrote to memory of 4296	4804	Microsoft_Toolkit.exe	update_5e6d00.exe
PID 4804 wrote to memory of 4296	4804	Microsoft_Toolkit.exe	update_5e6d00.exe
PID 4804 wrote to memory of 4272	4804	Microsoft_Toolkit.exe	setup.exe
PID 4804 wrote to memory of 4272	4804	Microsoft_Toolkit.exe	setup.exe
PID 4804 wrote to memory of 4272	4804	Microsoft_Toolkit.exe	setup.exe
PID 4272 wrote to memory of 892	4272	setup.exe	cmd.exe
PID 4272 wrote to memory of 892	4272	setup.exe	cmd.exe
PID 4272 wrote to memory of 892	4272	setup.exe	cmd.exe
PID 644 wrote to memory of 1184	644	proz.exe	Pas.exe
PID 644 wrote to memory of 1184	644	proz.exe	Pas.exe
PID 644 wrote to memory of 1184	644	proz.exe	Pas.exe
PID 892 wrote to memory of 2504	892	cmd.exe	PING.EXE
PID 892 wrote to memory of 2504	892	cmd.exe	PING.EXE
PID 892 wrote to memory of 2504	892	cmd.exe	PING.EXE
PID 3380 wrote to memory of 4492	3380	piyyy.exe	jfiag3g_gg.exe
PID 3380 wrote to memory of 4492	3380	piyyy.exe	jfiag3g_gg.exe
PID 3380 wrote to memory of 4492	3380	piyyy.exe	jfiag3g_gg.exe
PID 3744 wrote to memory of 4304	3744	KRSetp.exe	7279391.80
PID 3744 wrote to memory of 4304	3744	KRSetp.exe	7279391.80
PID 3744 wrote to memory of 4304	3744	KRSetp.exe	7279391.80
PID 4396 wrote to memory of 3408	4396	askinstall4.exe	cmd.exe
PID 4396 wrote to memory of 3408	4396	askinstall4.exe	cmd.exe
PID 4396 wrote to memory of 3408	4396	askinstall4.exe	cmd.exe
PID 3744 wrote to memory of 4312	3744	KRSetp.exe	226943.2
PID 3744 wrote to memory of 4312	3744	KRSetp.exe	226943.2
PID 3744 wrote to memory of 4312	3744	KRSetp.exe	226943.2
PID 3408 wrote to memory of 4488	3408	cmd.exe	taskkill.exe
PID 3408 wrote to memory of 4488	3408	cmd.exe	taskkill.exe
PID 3408 wrote to memory of 4488	3408	cmd.exe	taskkill.exe
PID 4312 wrote to memory of 1332	4312	226943.2	Windows Host.exe
PID 4312 wrote to memory of 1332	4312	226943.2	Windows Host.exe
PID 4312 wrote to memory of 1332	4312	226943.2	Windows Host.exe
PID 3380 wrote to memory of 4848	3380	piyyy.exe	jfiag3g_gg.exe
PID 3380 wrote to memory of 4848	3380	piyyy.exe	jfiag3g_gg.exe
PID 3380 wrote to memory of 4848	3380	piyyy.exe	jfiag3g_gg.exe
PID 2228 wrote to memory of 224	2228	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2228 wrote to memory of 224	2228	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2228 wrote to memory of 224	2228	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2228 wrote to memory of 224	2228	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1184 wrote to memory of 2956	1184	Pas.exe	cmd.exe
PID 1184 wrote to memory of 2956	1184	Pas.exe	cmd.exe
PID 1184 wrote to memory of 2956	1184	Pas.exe	cmd.exe
PID 2956 wrote to memory of 2156	2956	cmd.exe	timeout.exe
PID 2956 wrote to memory of 2156	2956	cmd.exe	timeout.exe
PID 2956 wrote to memory of 2156	2956	cmd.exe	timeout.exe
PID 2228 wrote to memory of 680	2228	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

C:\Users\Admin\AppData\Local\Temp\Microsoft_Toolkit.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft_Toolkit.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4804

C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
"C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3744

C:\Users\Admin\AppData\Roaming\7279391.80
"C:\Users\Admin\AppData\Roaming\7279391.80"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Users\Admin\AppData\Roaming\226943.2
"C:\Users\Admin\AppData\Roaming\226943.2"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4312

C:\ProgramData\Windows Host\Windows Host.exe
"C:\ProgramData\Windows Host\Windows Host.exe"
4⤵
- Executes dropped EXE
PID:1332

C:\Users\Admin\AppData\Local\Temp\jg7_7wjg.exe
"C:\Users\Admin\AppData\Local\Temp\jg7_7wjg.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Users\Admin\AppData\Local\Temp\proz.exe
"C:\Users\Admin\AppData\Local\Temp\proz.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:644

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pas.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pas.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pas.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:2956

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
5⤵
- Delays execution with timeout.exe
PID:2156

C:\Users\Admin\AppData\Local\Temp\ubisoftant.exe
"C:\Users\Admin\AppData\Local\Temp\ubisoftant.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3316

C:\Users\Admin\AppData\Local\Temp\askinstall4.exe
"C:\Users\Admin\AppData\Local\Temp\askinstall4.exe"
2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4396

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3408

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\setup.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
4⤵
- Runs ping.exe
PID:2504

C:\Users\Admin\AppData\Local\Temp\update_5e6d00.exe
"C:\Users\Admin\AppData\Local\Temp\update_5e6d00.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4296

C:\Users\Admin\AppData\Local\Temp\piyyy.exe
"C:\Users\Admin\AppData\Local\Temp\piyyy.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3380

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:4492

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4848

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2192

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1624

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:224

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1180

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:680

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4988

C:\Users\Admin\AppData\Local\Temp\1B88.exe
C:\Users\Admin\AppData\Local\Temp\1B88.exe
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:540

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Windows Host\Windows Host.exe
MD5
afa33dfbdad73a4e12c1af34d73133f2

SHA1
43924d73e58da7f3ea9c3ec8bf1dee26c441a11d

SHA256
7d3e9848965e09cc7acea44f59c66c28b3c57a5a902a8971b03d24a9634c14b1

SHA512
501d72dd1398332f363a5c0dee739b9d9908bb13a8549664b3b2bb1446d35b6228b0147d6ec32ea95c96f3e4a433e970b9fe3070460893d04facd0f82a40cc93

Download Submit
C:\ProgramData\Windows Host\Windows Host.exe
MD5
afa33dfbdad73a4e12c1af34d73133f2

SHA1
43924d73e58da7f3ea9c3ec8bf1dee26c441a11d

SHA256
7d3e9848965e09cc7acea44f59c66c28b3c57a5a902a8971b03d24a9634c14b1

SHA512
501d72dd1398332f363a5c0dee739b9d9908bb13a8549664b3b2bb1446d35b6228b0147d6ec32ea95c96f3e4a433e970b9fe3070460893d04facd0f82a40cc93

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
dd8c4461261fa8f470cbe436d82eb3e6

SHA1
8f221c4a2e8dacbdb325ac3f819e676cdc98b351

SHA256
12d490067715ee5a56f761aeb2f31c0d985f855b8e301a3b407b586809e95912

SHA512
f5ce46cef4e9c48148353e2995e33082fbab05bac1f171f55d3dcee936c7a4f09c1b24a4c92d58d7e608b8792c9fa1d2c280164bafb52a8b6988519f757d49f7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\5EE9003E3DC4134E8CF26DC55FD926FA
MD5
d93445c8e511e3d0bba872b3a6b2234f

SHA1
4150b3b767e559453b32d97994c698d5be6dd32e

SHA256
1692a0a8d09637d86c8351326104ee76ba618adbb5394398579969a52073c8a0

SHA512
9ccaa446534c22c8a9b93b038ca93e79c781b092d399f44bed3f0ea71678916347078d2076f783d3728677a547d037166334ad2d9a388d3f8e7fb0bb22c74684

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
f033f9e1c616b4383fd3e38232dd56c5

SHA1
2bd328510a0522715f71018819358d5308794eaa

SHA256
a84c5b14b5f2839fac45ad8e9d4953c23d551d4e11d2ecdf05d87caddb7dd6dc

SHA512
92177379dee9589670dfae2e7dbbd4903565be1f3ed8990e56154304f3c26657e42ef5856aeb1551d75c634f6c7b8b8dc7913afce129e56d2a016b1dcf17a41f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
5f642ffcd7c884431ac8783048ce5cc4

SHA1
bd71c91f959975762c95f8cbf213c85d519699ed

SHA256
d759ba395f3feee6e5431974ba9d8eb53c0426e15deffd6cac307e9a9d3245f1

SHA512
a27d90e03a69fa6ab7dd38fb9c3e5b78d76220c2cfd55ab84ebfb249aebb9578e59c38356935901da4c2b4a39ce3e79dd990ba2127478d0b4a307a48aa32ee0d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\5EE9003E3DC4134E8CF26DC55FD926FA
MD5
535712f46e1f7d1bf136e2b1445c8ed6

SHA1
c93c3837c47e4efb6129dd096108f33c0e2e3bfa

SHA256
1ad609ce37213fc99b65d02ac707b2d6e5269851f8c61d7c09533a7375dcae24

SHA512
5d7775be68c2b8be488010c2669305debbeb02917cdede8eccb89850367019066c993302c53207ab3354c278a2527bf3d1ce9deaadac3df03ff303f93100953c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
df40fe965c931a82529410622d334ed3

SHA1
8426525888781ee5bc7df6799661749bd299da6e

SHA256
650c33d791e0a19057170ccaf1764801c0d2467b156957cde9e0730a0324c17b

SHA512
d65a67e7bd7e742289d0e2c47070149ada4586f1ea80b574e44e1475103669210c11d716ee1672c95641d5ec49c177b6ddabf28384ecbfded940fc3eac5a989a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1B88.exe
MD5
77f49bbba904615a1198d9fbdf0040a2

SHA1
e8c5455b2cc1dfd21c26021c84c6b108fb59a8be

SHA256
77ca0da2c573125c6dcf6c5fed10da380fe9fcc1e29470909f8e79f249562f00

SHA512
4614ec80b9fc83a52cc6f8db45cef70f9eadcb730c9a9b44ac723152109511067d5df27bce28846e53c8a02ed82eb2f272b93feeb21091a47de5a73aaa8d2fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1B88.exe
MD5
77f49bbba904615a1198d9fbdf0040a2

SHA1
e8c5455b2cc1dfd21c26021c84c6b108fb59a8be

SHA256
77ca0da2c573125c6dcf6c5fed10da380fe9fcc1e29470909f8e79f249562f00

SHA512
4614ec80b9fc83a52cc6f8db45cef70f9eadcb730c9a9b44ac723152109511067d5df27bce28846e53c8a02ed82eb2f272b93feeb21091a47de5a73aaa8d2fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
MD5
ce82da74721b73ebca106db3d6c03101

SHA1
07dd2f58f2bfaec2aded4e380f57804c2ffe60bf

SHA256
2e21d96491d3f3f352d472e11064718fa6b8bf855ba11d167a8c6df42ced6181

SHA512
9752aadf0d83fa1df14ce4418b8b7a9b2e7c7530afd19fc6a8d5d4e908b89a5f51f945a7f0b4bcfba87e44fd130540e079ee9244c9658c94db187c748683ddde

Download Submit
C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
MD5
ce82da74721b73ebca106db3d6c03101

SHA1
07dd2f58f2bfaec2aded4e380f57804c2ffe60bf

SHA256
2e21d96491d3f3f352d472e11064718fa6b8bf855ba11d167a8c6df42ced6181

SHA512
9752aadf0d83fa1df14ce4418b8b7a9b2e7c7530afd19fc6a8d5d4e908b89a5f51f945a7f0b4bcfba87e44fd130540e079ee9244c9658c94db187c748683ddde

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pas.exe
MD5
db2e9f9b8807458226ca4cb9a52ff5c4

SHA1
94b8b1e0b9c617d370ad5d1445d410692529d23b

SHA256
a0f2ff7cb28c9f9c4e4d7583d2fbbcf89b5a2320f2dc8e82749a0f59e6ba197b

SHA512
68406f390ccb28893dcd7e36ec290f59ae9f86f2cd1e36e1596815ac664cda83ff3a8b833c963492bcadcd3620c844c28e87fb398444970e82418de02147ecf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pas.exe
MD5
db2e9f9b8807458226ca4cb9a52ff5c4

SHA1
94b8b1e0b9c617d370ad5d1445d410692529d23b

SHA256
a0f2ff7cb28c9f9c4e4d7583d2fbbcf89b5a2320f2dc8e82749a0f59e6ba197b

SHA512
68406f390ccb28893dcd7e36ec290f59ae9f86f2cd1e36e1596815ac664cda83ff3a8b833c963492bcadcd3620c844c28e87fb398444970e82418de02147ecf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\askinstall4.exe
MD5
53801ac3d522650a7c9a2f3e03b5c0a1

SHA1
b533a5eed14ecdc19159961df60e8aae58aee74b

SHA256
e28ff4f4b3871ebf761118f6ee0a8c1f600c90e54931f2e25030976906ed6568

SHA512
1e19561dae72756e7859298581ad859d844e879db8fd6e6f91a719a06b5dbf4f8cb690ab8adef3619f6ed9925bca39ae94609d071fdf043f7b85e1d5e6764c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\askinstall4.exe
MD5
53801ac3d522650a7c9a2f3e03b5c0a1

SHA1
b533a5eed14ecdc19159961df60e8aae58aee74b

SHA256
e28ff4f4b3871ebf761118f6ee0a8c1f600c90e54931f2e25030976906ed6568

SHA512
1e19561dae72756e7859298581ad859d844e879db8fd6e6f91a719a06b5dbf4f8cb690ab8adef3619f6ed9925bca39ae94609d071fdf043f7b85e1d5e6764c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\d
MD5
1114508f2fee2dcd3b0c574bfae8f91a

SHA1
dd58e7f1e64422063bf60e4ddbb2f038e4caa2c8

SHA256
d2d983c228968def2a3e8a46ac3b5b35a9bfdfded59e99fed1c25e6ac9a3bbce

SHA512
ac0d710b053f44e5849db247b68f8342a774ea92cf9daa0fc9400c106745a32bc7a8146eae705c1e2abd5ecab0e78e5b7b2464fb1ee4acfd6845d4079bdce463

Download Submit
C:\Users\Admin\AppData\Local\Temp\d
MD5
0767b54066c35cb42a3823c3ebd9e0f0

SHA1
3e6a1b89e2e24a95b1f005875b5b26f4b72eef3d

SHA256
f1903655d6c7f82e2c1985e43849bec4742b4d7417cb1778884ca3d9181a6fdd

SHA512
0c4cac8adbf709bf9ad2e28f2d9ac007f075f30ad75a3a820026cb2d5fcd00ef608a45cefe66f2dc7fffdc45f01054c1f1e503d379d0c8ffe9830aa82ecb59c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.INTEG.RAW
MD5
36b1ae2f090c4514bb5740e73174ded4

SHA1
27e97b4b936582cbb2d3b0c5c46a858bb276cef2

SHA256
3828a6430c82bb493723436062d8419799d22c766749caf73eb228f047faf3c6

SHA512
04c16c0902f02aa69032f93b4af2fe7b00d62e00377bc7b58f52696863463749a9f568226cb4c25a93246f06bab9efe192df72d0aed311fc96dcfa69f79d9c47

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.INTEG.RAW
MD5
1734930275ddf12dc919ea3d6c65c14f

SHA1
78010fc2b98d561e5b3e3a0f179acdd98c8828f9

SHA256
ece2712362bb31094f5bde620730f02acc3e0c6d3eac03cd410c9d86bce11c8d

SHA512
4c8ae78aed1f06f5e5db2c969991662e873ba66b2460b12e96695a43d07db0800b2e2d31e41ea58c3544c2825c9008a6a8eb52abbce3645a9fa560f5aa04275a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
a6279ec92ff948760ce53bba817d6a77

SHA1
5345505e12f9e4c6d569a226d50e71b5a572dce2

SHA256
8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

SHA512
213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
a6279ec92ff948760ce53bba817d6a77

SHA1
5345505e12f9e4c6d569a226d50e71b5a572dce2

SHA256
8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

SHA512
213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jg7_7wjg.exe
MD5
b319aba56f3a2c3fce5e3337acdfc849

SHA1
620879dbe04e71d8637104379581a95ff03c6025

SHA256
d2024a6ff6b174406d466890282e5d07f92e07ea5c64c2ef3f8d11397dcd6e70

SHA512
e1581c84bdfaf8f27d17dd9924a6c792fcb270e5d229328bdfdc258dae7f64fbb0d3ffb4ebbeaca643b1561c35dc2d507a638a0db3ddb189b78c357e89533e46

Download Submit
C:\Users\Admin\AppData\Local\Temp\jg7_7wjg.exe
MD5
b319aba56f3a2c3fce5e3337acdfc849

SHA1
620879dbe04e71d8637104379581a95ff03c6025

SHA256
d2024a6ff6b174406d466890282e5d07f92e07ea5c64c2ef3f8d11397dcd6e70

SHA512
e1581c84bdfaf8f27d17dd9924a6c792fcb270e5d229328bdfdc258dae7f64fbb0d3ffb4ebbeaca643b1561c35dc2d507a638a0db3ddb189b78c357e89533e46

Download Submit
C:\Users\Admin\AppData\Local\Temp\piyyy.exe
MD5
49939240c51965f0527297a3127b6c32

SHA1
78ab6d6f31a1b552a1a493b9f41690b6c47a28c3

SHA256
a7a20ca4cdcfd0e7b281e379889638207acd4b35e902caac95b894f02706129c

SHA512
abbd7a728a4dfc6b0ac04a9354172ef67e190f7b313e5cf7719e1240b4e2de12118ced45a1e7cd3494e4aad5420a28f01758b779269de8864b0f063e790b78ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\piyyy.exe
MD5
49939240c51965f0527297a3127b6c32

SHA1
78ab6d6f31a1b552a1a493b9f41690b6c47a28c3

SHA256
a7a20ca4cdcfd0e7b281e379889638207acd4b35e902caac95b894f02706129c

SHA512
abbd7a728a4dfc6b0ac04a9354172ef67e190f7b313e5cf7719e1240b4e2de12118ced45a1e7cd3494e4aad5420a28f01758b779269de8864b0f063e790b78ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\proz.exe
MD5
87930a2af638eab739a4925e5efb66be

SHA1
faa3701185a42c844020947407aec0c642fb96db

SHA256
5ea59c6498dd18d506f324a8b61f1a7c9008380f37ea6af60c308c05dfa0c371

SHA512
764928f88b53a5ccae09a1dee134fadcea6105c036dd6a53b97b57e7ef0577782ea569bcf8dfc6371fbb6ec9f1569c28fa3602de3ca669134febb0f039341ea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\proz.exe
MD5
87930a2af638eab739a4925e5efb66be

SHA1
faa3701185a42c844020947407aec0c642fb96db

SHA256
5ea59c6498dd18d506f324a8b61f1a7c9008380f37ea6af60c308c05dfa0c371

SHA512
764928f88b53a5ccae09a1dee134fadcea6105c036dd6a53b97b57e7ef0577782ea569bcf8dfc6371fbb6ec9f1569c28fa3602de3ca669134febb0f039341ea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
MD5
931a67fffb696d947a1cf5de4e02193a

SHA1
04d185b5641c394bf16ee0712c503622c81021bd

SHA256
36fcc164264719077c074a60132a51627f4f2fdd5ff775a549685349945c0bf9

SHA512
51c608c8b7ca11ba05b051aca54e9fbccad321f34a1ddb22619e687a5a86c9f7020299383ef90792da87941086943489a0bc2d1af10287ce69cd99f56a168f02

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
MD5
931a67fffb696d947a1cf5de4e02193a

SHA1
04d185b5641c394bf16ee0712c503622c81021bd

SHA256
36fcc164264719077c074a60132a51627f4f2fdd5ff775a549685349945c0bf9

SHA512
51c608c8b7ca11ba05b051aca54e9fbccad321f34a1ddb22619e687a5a86c9f7020299383ef90792da87941086943489a0bc2d1af10287ce69cd99f56a168f02

Download Submit
C:\Users\Admin\AppData\Local\Temp\ubisoftant.exe
MD5
9d778c2eb91a8b335cc085ffc5728a17

SHA1
8ff274de9a05b447341d8821dad63f461913045c

SHA256
9ff78393a5e67786ed14a4f019ab112b1ca1c977d8b35b107871ccff7a0f44d0

SHA512
fb7b4c07d58e3f771e126c8d89d9735347189351f72d5470c84c99d539fdd2ea6a7b1595d8b55a9334c12d53fde8973511aecbbf76959df253e9c6a4e0223deb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ubisoftant.exe
MD5
9d778c2eb91a8b335cc085ffc5728a17

SHA1
8ff274de9a05b447341d8821dad63f461913045c

SHA256
9ff78393a5e67786ed14a4f019ab112b1ca1c977d8b35b107871ccff7a0f44d0

SHA512
fb7b4c07d58e3f771e126c8d89d9735347189351f72d5470c84c99d539fdd2ea6a7b1595d8b55a9334c12d53fde8973511aecbbf76959df253e9c6a4e0223deb

Download Submit
C:\Users\Admin\AppData\Local\Temp\update_5e6d00.exe
MD5
9b556d99e3f32187b336a7d091e298f3

SHA1
fd132cf3106584a106909f3d96f476a1aede6043

SHA256
22167c9d39466648b4544fc60d48e631b743b73e1cab0fe179223e4785e3a6e3

SHA512
aa50f8d8f72869fcfc02ed0ef306aaa2a2076f0eea3a27b0d0e0a8a0a1f86502d5ef1e0e4a1f29ad985623b0d99dd4cf90f834fb4bdd5bce06ebc5fc3ef30c6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\update_5e6d00.exe
MD5
9b556d99e3f32187b336a7d091e298f3

SHA1
fd132cf3106584a106909f3d96f476a1aede6043

SHA256
22167c9d39466648b4544fc60d48e631b743b73e1cab0fe179223e4785e3a6e3

SHA512
aa50f8d8f72869fcfc02ed0ef306aaa2a2076f0eea3a27b0d0e0a8a0a1f86502d5ef1e0e4a1f29ad985623b0d99dd4cf90f834fb4bdd5bce06ebc5fc3ef30c6f

Download Submit
C:\Users\Admin\AppData\Roaming\226943.2
MD5
afa33dfbdad73a4e12c1af34d73133f2

SHA1
43924d73e58da7f3ea9c3ec8bf1dee26c441a11d

SHA256
7d3e9848965e09cc7acea44f59c66c28b3c57a5a902a8971b03d24a9634c14b1

SHA512
501d72dd1398332f363a5c0dee739b9d9908bb13a8549664b3b2bb1446d35b6228b0147d6ec32ea95c96f3e4a433e970b9fe3070460893d04facd0f82a40cc93

Download Submit
C:\Users\Admin\AppData\Roaming\226943.2
MD5
afa33dfbdad73a4e12c1af34d73133f2

SHA1
43924d73e58da7f3ea9c3ec8bf1dee26c441a11d

SHA256
7d3e9848965e09cc7acea44f59c66c28b3c57a5a902a8971b03d24a9634c14b1

SHA512
501d72dd1398332f363a5c0dee739b9d9908bb13a8549664b3b2bb1446d35b6228b0147d6ec32ea95c96f3e4a433e970b9fe3070460893d04facd0f82a40cc93

Download Submit
C:\Users\Admin\AppData\Roaming\7279391.80
MD5
69bb7d62ee270b8ff0a1b488001b4f04

SHA1
f7ec7faab491fe6bd2627a965b6a368991851be3

SHA256
b918c782ece8ecc4f8419002fc703df0d5e07b8c6d70d3bbbb46f8ef96453be1

SHA512
f19bb79d5274e956a29834bf22612a9417313440b53469a2b19a701377b00a15b5dd89199d3f4a3d5c0fa6f54457129134f83e0d6b571c78259223536a30706c

Download Submit
C:\Users\Admin\AppData\Roaming\7279391.80
MD5
69bb7d62ee270b8ff0a1b488001b4f04

SHA1
f7ec7faab491fe6bd2627a965b6a368991851be3

SHA256
b918c782ece8ecc4f8419002fc703df0d5e07b8c6d70d3bbbb46f8ef96453be1

SHA512
f19bb79d5274e956a29834bf22612a9417313440b53469a2b19a701377b00a15b5dd89199d3f4a3d5c0fa6f54457129134f83e0d6b571c78259223536a30706c

Download Submit
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\freebl3.dll
MD5
60acd24430204ad2dc7f148b8cfe9bdc

SHA1
989f377b9117d7cb21cbe92a4117f88f9c7693d9

SHA256
9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

SHA512
626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

Download Submit
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\freebl3.dll
MD5
60acd24430204ad2dc7f148b8cfe9bdc

SHA1
989f377b9117d7cb21cbe92a4117f88f9c7693d9

SHA256
9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

SHA512
626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

Download Submit
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\mozglue.dll
MD5
eae9273f8cdcf9321c6c37c244773139

SHA1
8378e2a2f3635574c106eea8419b5eb00b8489b0

SHA256
a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

SHA512
06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

Download Submit
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\nss3.dll
MD5
02cc7b8ee30056d5912de54f1bdfc219

SHA1
a6923da95705fb81e368ae48f93d28522ef552fb

SHA256
1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

SHA512
0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

Download Submit
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\softokn3.dll
MD5
4e8df049f3459fa94ab6ad387f3561ac

SHA1
06ed392bc29ad9d5fc05ee254c2625fd65925114

SHA256
25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

SHA512
3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll
MD5
f964811b68f9f1487c2b41e1aef576ce

SHA1
b423959793f14b1416bc3b7051bed58a1034025f

SHA256
83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

SHA512
565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

Download Submit
\Users\Admin\AppData\Local\Temp\CC4F.tmp
MD5
50741b3f2d7debf5d2bed63d88404029

SHA1
56210388a627b926162b36967045be06ffb1aad3

SHA256
f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

SHA512
fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

Download Submit
memory/540-108-0x0000000000000000-mapping.dmp

Download
memory/540-111-0x0000000004971000-0x0000000004972000-memory.dmp

Filesize
4KB

Download
memory/540-112-0x0000000004A60000-0x0000000004A61000-memory.dmp

Filesize
4KB

Download
memory/644-10-0x0000000000000000-mapping.dmp

Download
memory/756-6-0x0000000000000000-mapping.dmp

Download
memory/892-31-0x0000000000000000-mapping.dmp

Download
memory/1184-39-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/1184-36-0x0000000000000000-mapping.dmp

Download
memory/1332-84-0x00000000074D0000-0x00000000074D1000-memory.dmp

Filesize
4KB

Download
memory/1332-74-0x000000006F9B0000-0x000000007009E000-memory.dmp

Filesize
6.9MB

Download
memory/1332-69-0x0000000000000000-mapping.dmp

Download
memory/2156-101-0x0000000000000000-mapping.dmp

Download
memory/2504-40-0x0000000000000000-mapping.dmp

Download
memory/2956-100-0x0000000000000000-mapping.dmp

Download
memory/3152-85-0x0000000002F50000-0x0000000002F66000-memory.dmp

Filesize
88KB

Download
memory/3316-12-0x0000000000000000-mapping.dmp

Download
memory/3380-17-0x0000000000000000-mapping.dmp

Download
memory/3408-46-0x0000000000000000-mapping.dmp

Download
memory/3744-35-0x0000000000C60000-0x0000000000C61000-memory.dmp

Filesize
4KB

Download
memory/3744-3-0x0000000000000000-mapping.dmp

Download
memory/3744-25-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/3744-32-0x0000000000F60000-0x0000000000F83000-memory.dmp

Filesize
140KB

Download
memory/3744-9-0x00007FFA610F0000-0x00007FFA61ADC000-memory.dmp

Filesize
9.9MB

Download
memory/3744-30-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/4272-26-0x0000000000000000-mapping.dmp

Download
memory/4296-20-0x0000000000000000-mapping.dmp

Download
memory/4296-33-0x0000000004C40000-0x0000000004C41000-memory.dmp

Filesize
4KB

Download
memory/4304-58-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/4304-53-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4304-66-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/4304-49-0x000000006F9B0000-0x000000007009E000-memory.dmp

Filesize
6.9MB

Download
memory/4304-93-0x0000000005540000-0x0000000005541000-memory.dmp

Filesize
4KB

Download
memory/4304-64-0x000000000A4D0000-0x000000000A501000-memory.dmp

Filesize
196KB

Download
memory/4304-44-0x0000000000000000-mapping.dmp

Download
memory/4304-86-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/4312-59-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/4312-55-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/4312-63-0x00000000045B0000-0x00000000045B1000-memory.dmp

Filesize
4KB

Download
memory/4312-62-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/4312-52-0x000000006F9B0000-0x000000007009E000-memory.dmp

Filesize
6.9MB

Download
memory/4312-60-0x00000000009D0000-0x00000000009E0000-memory.dmp

Filesize
64KB

Download
memory/4312-48-0x0000000000000000-mapping.dmp

Download
memory/4312-61-0x00000000052A0000-0x00000000052A1000-memory.dmp

Filesize
4KB

Download
memory/4396-14-0x0000000000000000-mapping.dmp

Download
memory/4488-57-0x0000000000000000-mapping.dmp

Download
memory/4492-41-0x0000000000000000-mapping.dmp

Download
memory/4848-88-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads