plugx | afdbdff7a2510b208b5ebc47ac621ff14a15aa5673ed6cdf7f7f0f8ad4c1e1fb

Analysis

max time kernel
76s
max time network
83s
platform
windows10_x64
resource
win10v20210408
submitted
26-06-2021 09:03

Sharing

Copy URL

Twitter E-mail

Reason

Remote task has failed: Machine shutdown

Report Analysis Logs

General

Target

a0398eaee184bdd5da2ded03fd02e598.exe
Size

3.0MB
MD5

a0398eaee184bdd5da2ded03fd02e598
SHA1

46141e70b28544d6c3cccca56e35a52f3cb4671d
SHA256

afdbdff7a2510b208b5ebc47ac621ff14a15aa5673ed6cdf7f7f0f8ad4c1e1fb
SHA512

6ce539db52dba2fc08c40db1278f9138cb1fef758b1efc2057ed19338523a5c8013ed2f99b109c10e8bbb6b3b4d782a93086afd3cdf401bb58548aa2e12ec314

Score

10^/10

plugx raccoon smokeloader vidar backdoor bootkit discovery evasion persistence spyware stealer trojan upx vmprotect

Malware Config

Extracted

Family

smokeloader

Version

2020

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/

rc4.i32

Signatures

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/2584-194-0x00000000024B0000-0x000000000254D000-memory.dmp	Vidar
behavioral2/memory/2584-202-0x0000000000400000-0x000000000094A000-memory.dmp	Vidar

Downloads MZ/PE file

Executes dropped EXE 13 IoCs

Processes:

Files.exeKRSetp.exeFile.exerun.exerun2.exejg3_3uag.exepzyh.exepub2.exeFolder.exejfiag3g_gg.exeConhost.exerun2.exeB249.exe

pid	process
2692	Files.exe
2772	KRSetp.exe
2652	File.exe
2584	run.exe
2044	run2.exe
3400	jg3_3uag.exe
2352	pzyh.exe
2784	pub2.exe
4128	Folder.exe
4300	jfiag3g_gg.exe
4836	Conhost.exe
5232	run2.exe
5728	B249.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe	vmprotect
behavioral2/memory/3400-146-0x0000000000400000-0x00000000005E6000-memory.dmp	vmprotect
C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe	vmprotect

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Files.exea0398eaee184bdd5da2ded03fd02e598.exeFolder.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Files.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	a0398eaee184bdd5da2ded03fd02e598.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Folder.exe

Loads dropped DLL 9 IoCs

Processes:

cmd.exepub2.exerun.exerun2.exe

pid process

4416 cmd.exe
2784 pub2.exe
2584 run.exe
2584 run.exe
5232 run2.exe
5232 run2.exe
5232 run2.exe
5232 run2.exe
5232 run2.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

pzyh.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.e"	pzyh.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

jg3_3uag.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg3_3uag.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 ip-api.com
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

B249.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 B249.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg3_3uag.exe

flow	ioc
18	ip-api.com

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	B249.exe

Drops file in System32 directory 2 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent E64C6FFA5032C49E	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

svchost.exerun2.exe

description	pid	process	target process
PID 884 set thread context of 4544	884	svchost.exe	svchost.exe
PID 2044 set thread context of 5232	2044	run2.exe	run2.exe

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe	autoit_exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

pub2.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exerun.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	run.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	run.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

5668 timeout.exe
5220 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4448 taskkill.exe

pid	process
5668	timeout.exe
5220	timeout.exe

pid	process
4448	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 13 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.execmd.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62FM2EJ3-714D-A09D-WM25-6QFJ226I1FER}\1 = "30"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 1d24df8b702cd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1b1b3e7e7a6ad701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000e56aedd3153272d50359596b2e7133833d8326741a3939687a53eda51c50fc12b6754dbd6ab16c7c9cfa720af32a1bb092761783a4feeb611422d58a7784c31a82f947fbc2c51a5196ddda2d78219e7224b3697499e97d9cfa81678a2005358ddf96a1dea98e775cbea16ecec674f2b271d8af247019f5c073125fe06af35f0a85ec167d342d406527e71e8e4e451833d986203138ae414d7274641e156e2fc96c9b448932c0e86f344d31c5e0b2abf1725e1ad345c8edf5f046e5fb3e96d5136243d3b7e9686c8840740f1d38ddef58e8fef4508e86315d462aa03bb38bc8aa0c84f3b64e4695dfddfcef39a3e4b03f500867f9900a341713bf109d8a6de3e825fe36b35478f338c785d0f31ae9aeb9091a92b46273d9fb94a499dce55c3abb2351e970f51f5da388afe809950a34b98cd5cf2353e193ce027b1ccaf978a26bca1cefeed95ba78a641bc3fb1f69d97d2adacb4bbc73743279e31e68d1e14738fb010da0634d0911726725f47d2575d5d4c79ed5d54b28eac17b2720d8b769bbb69f9d3101137cbc0434e6c3f35dbd2c1b3e72df7688997432944365de234f5582f78efa8faa	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 1d24df8b702cd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{8D8EA98C-C327-47F6-BC73-FD2B293F441D} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69RG4ZP0-857P-S13A-ZW93-6DTG316B7ZWC}\7289246C77593EBF	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45AC2TN3-666M-M32E-TO40-1MIP137D5TOZ}\1 = "4948"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000001f2d276367530ac6a9bc606610edcdb49717e55b0b64730da41a7daad022b28b4686cc16ece740a2e11ec90eb965929c54cd9f3566e3a024febda85f7ddae2bb1b80b7d574996abe6f2a0ce2e199287db62129852ce9d97646bd	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d9685a797a6ad701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 1d24df8b702cd701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{4020EBCE-9448-47CC-BF50-09DE2E22F173}"	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

cmd.exesvchost.exepub2.exeConhost.exerun.exe

pid	process
4416	cmd.exe
4416	cmd.exe
884	svchost.exe
884	svchost.exe
2784	pub2.exe
2784	pub2.exe
4836	Conhost.exe
4836	Conhost.exe
2584	run.exe
2584	run.exe
2584	run.exe
2584	run.exe
2584	run.exe
2584	run.exe
2584	run.exe
2584	run.exe
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428
2428

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2428
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

pub2.exeMicrosoftEdgeCP.exe

pid process

2784 pub2.exe
4380 MicrosoftEdgeCP.exe
4380 MicrosoftEdgeCP.exe

pid	process
2428

pid	process
2784	pub2.exe
4380	MicrosoftEdgeCP.exe
4380	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

KRSetp.exeMicrosoftEdge.execmd.exesvchost.exejg3_3uag.exeMicrosoftEdgeCP.exesvchost.exetaskkill.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	2772	KRSetp.exe
Token: SeDebugPrivilege	2704	MicrosoftEdge.exe
Token: SeDebugPrivilege	2704	MicrosoftEdge.exe
Token: SeDebugPrivilege	2704	MicrosoftEdge.exe
Token: SeDebugPrivilege	2704	MicrosoftEdge.exe
Token: SeDebugPrivilege	4416	cmd.exe
Token: SeDebugPrivilege	4416	cmd.exe
Token: SeDebugPrivilege	884	svchost.exe
Token: SeDebugPrivilege	4416	cmd.exe
Token: SeDebugPrivilege	4416	cmd.exe
Token: SeDebugPrivilege	4416	cmd.exe
Token: SeDebugPrivilege	4416	cmd.exe
Token: SeDebugPrivilege	4416	cmd.exe
Token: SeDebugPrivilege	4416	cmd.exe
Token: SeDebugPrivilege	4416	cmd.exe
Token: SeDebugPrivilege	4416	cmd.exe
Token: SeDebugPrivilege	4416	cmd.exe
Token: SeDebugPrivilege	4416	cmd.exe
Token: SeDebugPrivilege	4416	cmd.exe
Token: SeManageVolumePrivilege	3400	jg3_3uag.exe
Token: SeDebugPrivilege	4988	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4988	MicrosoftEdgeCP.exe
Token: SeAuditPrivilege	2324	svchost.exe
Token: SeAuditPrivilege	2324	svchost.exe
Token: SeDebugPrivilege	4988	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4988	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	2428
Token: SeCreatePagefilePrivilege	2428
Token: SeShutdownPrivilege	2428
Token: SeCreatePagefilePrivilege	2428
Token: SeShutdownPrivilege	2428
Token: SeCreatePagefilePrivilege	2428
Token: SeShutdownPrivilege	2428
Token: SeCreatePagefilePrivilege	2428
Token: SeManageVolumePrivilege	3400	jg3_3uag.exe
Token: SeShutdownPrivilege	2428
Token: SeCreatePagefilePrivilege	2428
Token: SeShutdownPrivilege	2428
Token: SeCreatePagefilePrivilege	2428
Token: SeShutdownPrivilege	2428
Token: SeCreatePagefilePrivilege	2428
Token: SeShutdownPrivilege	2428
Token: SeCreatePagefilePrivilege	2428
Token: SeShutdownPrivilege	2428
Token: SeCreatePagefilePrivilege	2428
Token: SeDebugPrivilege	4448	taskkill.exe
Token: SeAssignPrimaryTokenPrivilege	2616	svchost.exe
Token: SeIncreaseQuotaPrivilege	2616	svchost.exe
Token: SeSecurityPrivilege	2616	svchost.exe
Token: SeTakeOwnershipPrivilege	2616	svchost.exe
Token: SeLoadDriverPrivilege	2616	svchost.exe
Token: SeSystemtimePrivilege	2616	svchost.exe
Token: SeBackupPrivilege	2616	svchost.exe
Token: SeRestorePrivilege	2616	svchost.exe
Token: SeShutdownPrivilege	2616	svchost.exe
Token: SeSystemEnvironmentPrivilege	2616	svchost.exe
Token: SeUndockPrivilege	2616	svchost.exe
Token: SeManageVolumePrivilege	2616	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2616	svchost.exe
Token: SeIncreaseQuotaPrivilege	2616	svchost.exe
Token: SeSecurityPrivilege	2616	svchost.exe
Token: SeTakeOwnershipPrivilege	2616	svchost.exe
Token: SeLoadDriverPrivilege	2616	svchost.exe
Token: SeSystemtimePrivilege	2616	svchost.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

File.exe

pid process

2652 File.exe
2652 File.exe
2652 File.exe
2652 File.exe
2652 File.exe
2652 File.exe
2652 File.exe
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

File.exe

pid process

2652 File.exe
2652 File.exe
2652 File.exe
2652 File.exe
2652 File.exe
2652 File.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

2704 MicrosoftEdge.exe
4380 MicrosoftEdgeCP.exe
4380 MicrosoftEdgeCP.exe

pid	process
2652	File.exe
2652	File.exe
2652	File.exe
2652	File.exe
2652	File.exe
2652	File.exe
2652	File.exe

pid	process
2652	File.exe
2652	File.exe
2652	File.exe
2652	File.exe
2652	File.exe
2652	File.exe

pid	process
2704	MicrosoftEdge.exe
4380	MicrosoftEdgeCP.exe
4380	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a0398eaee184bdd5da2ded03fd02e598.exeFiles.exeFile.exepzyh.exeFolder.execmd.exesvchost.exerun.exerun2.exe

description	pid	process	target process
PID 632 wrote to memory of 2692	632	a0398eaee184bdd5da2ded03fd02e598.exe	Files.exe
PID 632 wrote to memory of 2692	632	a0398eaee184bdd5da2ded03fd02e598.exe	Files.exe
PID 632 wrote to memory of 2692	632	a0398eaee184bdd5da2ded03fd02e598.exe	Files.exe
PID 632 wrote to memory of 2772	632	a0398eaee184bdd5da2ded03fd02e598.exe	KRSetp.exe
PID 632 wrote to memory of 2772	632	a0398eaee184bdd5da2ded03fd02e598.exe	KRSetp.exe
PID 2692 wrote to memory of 2652	2692	Files.exe	File.exe
PID 2692 wrote to memory of 2652	2692	Files.exe	File.exe
PID 2692 wrote to memory of 2652	2692	Files.exe	File.exe
PID 2652 wrote to memory of 2584	2652	File.exe	run.exe
PID 2652 wrote to memory of 2584	2652	File.exe	run.exe
PID 2652 wrote to memory of 2584	2652	File.exe	run.exe
PID 2652 wrote to memory of 2044	2652	File.exe	run2.exe
PID 2652 wrote to memory of 2044	2652	File.exe	run2.exe
PID 2652 wrote to memory of 2044	2652	File.exe	run2.exe
PID 632 wrote to memory of 3400	632	a0398eaee184bdd5da2ded03fd02e598.exe	jg3_3uag.exe
PID 632 wrote to memory of 3400	632	a0398eaee184bdd5da2ded03fd02e598.exe	jg3_3uag.exe
PID 632 wrote to memory of 3400	632	a0398eaee184bdd5da2ded03fd02e598.exe	jg3_3uag.exe
PID 632 wrote to memory of 2352	632	a0398eaee184bdd5da2ded03fd02e598.exe	pzyh.exe
PID 632 wrote to memory of 2352	632	a0398eaee184bdd5da2ded03fd02e598.exe	pzyh.exe
PID 632 wrote to memory of 2352	632	a0398eaee184bdd5da2ded03fd02e598.exe	pzyh.exe
PID 632 wrote to memory of 2784	632	a0398eaee184bdd5da2ded03fd02e598.exe	pub2.exe
PID 632 wrote to memory of 2784	632	a0398eaee184bdd5da2ded03fd02e598.exe	pub2.exe
PID 632 wrote to memory of 2784	632	a0398eaee184bdd5da2ded03fd02e598.exe	pub2.exe
PID 632 wrote to memory of 4128	632	a0398eaee184bdd5da2ded03fd02e598.exe	Folder.exe
PID 632 wrote to memory of 4128	632	a0398eaee184bdd5da2ded03fd02e598.exe	Folder.exe
PID 632 wrote to memory of 4128	632	a0398eaee184bdd5da2ded03fd02e598.exe	Folder.exe
PID 2352 wrote to memory of 4300	2352	pzyh.exe	jfiag3g_gg.exe
PID 2352 wrote to memory of 4300	2352	pzyh.exe	jfiag3g_gg.exe
PID 2352 wrote to memory of 4300	2352	pzyh.exe	jfiag3g_gg.exe
PID 4128 wrote to memory of 4416	4128	Folder.exe	cmd.exe
PID 4128 wrote to memory of 4416	4128	Folder.exe	cmd.exe
PID 4128 wrote to memory of 4416	4128	Folder.exe	cmd.exe
PID 4416 wrote to memory of 884	4416	cmd.exe	svchost.exe
PID 4416 wrote to memory of 2632	4416	cmd.exe	svchost.exe
PID 884 wrote to memory of 4544	884	svchost.exe	svchost.exe
PID 884 wrote to memory of 4544	884	svchost.exe	svchost.exe
PID 884 wrote to memory of 4544	884	svchost.exe	svchost.exe
PID 4416 wrote to memory of 64	4416	cmd.exe	svchost.exe
PID 4416 wrote to memory of 2364	4416	cmd.exe	svchost.exe
PID 4416 wrote to memory of 2324	4416	cmd.exe	svchost.exe
PID 4416 wrote to memory of 1096	4416	cmd.exe	svchost.exe
PID 4416 wrote to memory of 1044	4416	cmd.exe	svchost.exe
PID 4416 wrote to memory of 1404	4416	cmd.exe	svchost.exe
PID 4416 wrote to memory of 1848	4416	cmd.exe	svchost.exe
PID 4416 wrote to memory of 1204	4416	cmd.exe	svchost.exe
PID 4416 wrote to memory of 1248	4416	cmd.exe	svchost.exe
PID 4416 wrote to memory of 2616	4416	cmd.exe	svchost.exe
PID 4416 wrote to memory of 2624	4416	cmd.exe	svchost.exe
PID 2352 wrote to memory of 4836	2352	pzyh.exe	Conhost.exe
PID 2352 wrote to memory of 4836	2352	pzyh.exe	Conhost.exe
PID 2352 wrote to memory of 4836	2352	pzyh.exe	Conhost.exe
PID 2584 wrote to memory of 4416	2584	run.exe	cmd.exe
PID 2584 wrote to memory of 4416	2584	run.exe	cmd.exe
PID 2584 wrote to memory of 4416	2584	run.exe	cmd.exe
PID 4416 wrote to memory of 4448	4416	cmd.exe	taskkill.exe
PID 4416 wrote to memory of 4448	4416	cmd.exe	taskkill.exe
PID 4416 wrote to memory of 4448	4416	cmd.exe	taskkill.exe
PID 4416 wrote to memory of 5220	4416	cmd.exe	timeout.exe
PID 4416 wrote to memory of 5220	4416	cmd.exe	timeout.exe
PID 4416 wrote to memory of 5220	4416	cmd.exe	timeout.exe
PID 2044 wrote to memory of 5232	2044	run2.exe	run2.exe
PID 2044 wrote to memory of 5232	2044	run2.exe	run2.exe
PID 2044 wrote to memory of 5232	2044	run2.exe	run2.exe
PID 2044 wrote to memory of 5232	2044	run2.exe	run2.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1096

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2632

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2624

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2616

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2364

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2324

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1848

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1404

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1248

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1204

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:1044

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:64

C:\Users\Admin\AppData\Local\Temp\a0398eaee184bdd5da2ded03fd02e598.exe
"C:\Users\Admin\AppData\Local\Temp\a0398eaee184bdd5da2ded03fd02e598.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:632

C:\Users\Admin\AppData\Local\Temp\Files.exe
"C:\Users\Admin\AppData\Local\Temp\Files.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2692

C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2652

C:\Users\Public\run.exe
C:\Users\Public\run.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2584

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im run.exe /f & timeout /t 6 & del /f /q "C:\Users\Public\run.exe" & del C:\ProgramData\*.dll & exit
5⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4836

C:\Windows\SysWOW64\taskkill.exe
taskkill /im run.exe /f
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
6⤵
- Delays execution with timeout.exe
PID:5220

C:\Users\Public\run2.exe
C:\Users\Public\run2.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Public\run2.exe
C:\Users\Public\run2.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5232

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\run2.exe"
6⤵
PID:5632

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
7⤵
- Delays execution with timeout.exe
PID:5668

C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
"C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
"C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:3400

C:\Users\Admin\AppData\Local\Temp\pzyh.exe
"C:\Users\Admin\AppData\Local\Temp\pzyh.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2352

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:4300

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
PID:4836

C:\Users\Admin\AppData\Local\Temp\pub2.exe
"C:\Users\Admin\AppData\Local\Temp\pub2.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2784

C:\Users\Admin\AppData\Local\Temp\Folder.exe
"C:\Users\Admin\AppData\Local\Temp\Folder.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4128

C:\Windows\SysWOW64\rUNdlL32.eXe
"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
3⤵
PID:4416

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4544

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2704

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3188

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4380

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4144

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4556

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4880

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4088

C:\Users\Admin\AppData\Local\Temp\B249.exe
C:\Users\Admin\AppData\Local\Temp\B249.exe
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:5728

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\freebl3.dll
MD5
ef2834ac4ee7d6724f255beaf527e635

SHA1
5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

SHA256
a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

SHA512
c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

Download Submit
C:\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
C:\ProgramData\msvcp140.dll
MD5
109f0f02fd37c84bfc7508d4227d7ed5

SHA1
ef7420141bb15ac334d3964082361a460bfdb975

SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

Download Submit
C:\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
C:\ProgramData\softokn3.dll
MD5
a2ee53de9167bf0d6c019303b7ca84e5

SHA1
2a3c737fa1157e8483815e98b666408a18c0db42

SHA256
43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

SHA512
45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

Download Submit
C:\ProgramData\vcruntime140.dll
MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
14dc976d32a78e25bb29b86073a53053

SHA1
3c795c5b8c0052b7a9b022db1e6f11d9a7b5d412

SHA256
5f5768f70057eacf9a403175746e0561531af0f93f974f95de5a8b2b3bf15caf

SHA512
74433d5d067d6b34f8f56822d433dac6f7788e8e9a830b93290685949fb4650c43099283628417dc4b6db997eff7768f92d45be4f71132f26b372f2deca15b11

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\5EE9003E3DC4134E8CF26DC55FD926FA
MD5
6094e692a35504328685cbd8e5965a1a

SHA1
b0c0300c33b887ec52a9893536bd58a6120d32b0

SHA256
202e23c1f98b70cc8fd82f5c1b9519819e2f9768fb84a73fbcbbbc2a8e737cc6

SHA512
54b47d0c5cd87907b06b46e8ea3ec95b2121e8dda0dc01f97d3baa8cd25c505348e99babf343db41e0380112a25e7c57f6195a17437f4b46ddea3f0ae3cf1c38

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
31264fb7902cf398c3f95d131e2fb14e

SHA1
b8518be5d888bdc964969f65da1d6af94366b551

SHA256
5cfd615bcd333821d8a2ea43e812c86c6a0852522dee4e118b3ac2bfa0d431fb

SHA512
d7d342a345780df0acf9744981658a84441c3a380ea450261c254b3162f4316c46281df3f391ad3af724938192089df3e624521261d7f135a67f0a91ff997090

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
36aa64d5dbec616597f25a099dbc175b

SHA1
56442ad0ec6e145ffbb9c9c4047dff952296edf8

SHA256
0b5fae24cbb697130372dca0451cd25e208d4966318f50daa074cf50e56e7230

SHA512
46491c8e4ae4727cc3ca5a6494e0e3df3da4e35bf8185b52292dce1cd971e0a5e93bd91407d48a773b5870214193cab58e3d19c8faef34d0b7f883ecf6c6bbd5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\5EE9003E3DC4134E8CF26DC55FD926FA
MD5
fc3f9b25ed79b54a5c8ae178f7c95864

SHA1
d81942869c540fd79f29241b11fa60c91f8448ad

SHA256
084c0b98347dd97b461ed9a0ac1d8012fe7112ba16c653b910d6c92205babfc5

SHA512
f94ac252e36f9049efd1844444a39067665025ce3cd56472056ebf0a4a0b8026e842c8d2440b0e9c8cf2b921da8f7af49e60efb3bc8a4d78d55c6270758397a7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
15165e33fcdbd58d76bf10c72b6ae8a4

SHA1
792a296a471383ce02382b528f757488aa9cd751

SHA256
2ab3fe16bb72fb32da0f7a97984b83af90e711d60e20a43e6981aca4f81d12e8

SHA512
79e90205efb29007c2f411fd3cba4bb6e510e075f675c2e763ca71ac2343191d4f19373198359ef60e02fbd32a1cc8008522781322971aa6d966177aeb919494

Download Submit
C:\Users\Admin\AppData\Local\Temp\B249.exe
MD5
afcbda116eb104988e537d83331c7a20

SHA1
76c10736f41637952612d4eaa8610fad44766f28

SHA256
c39f2678c2d5bcbedf4c92dae2d36d66357c34cc78559a1d9a62a6e3616ce991

SHA512
777f35c088226a69beb823626a4ace8f29290c19383ead99bd1c088fa8ddabc7dd63ddbdbbc1d9906c5cd1787f7ffcb0d667e772fb1e224f2952dda59312bb38

Download Submit
C:\Users\Admin\AppData\Local\Temp\B249.exe
MD5
afcbda116eb104988e537d83331c7a20

SHA1
76c10736f41637952612d4eaa8610fad44766f28

SHA256
c39f2678c2d5bcbedf4c92dae2d36d66357c34cc78559a1d9a62a6e3616ce991

SHA512
777f35c088226a69beb823626a4ace8f29290c19383ead99bd1c088fa8ddabc7dd63ddbdbbc1d9906c5cd1787f7ffcb0d667e772fb1e224f2952dda59312bb38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files.exe
MD5
b5e65b9ed68345636843148a8e26ff70

SHA1
330f639268b1f0df4637ab2fed0f0be075b01aee

SHA256
0a58135439cddf79a4cdb3e784b527cc1dcdc663279be398f5291b62144d7695

SHA512
2f5b41748ef3ac0c15af2f20b51fe2794e8159beaafbd1e06444a29c2abff20c909b07e1dea8b9bf8e052b8b7fe8b864ab3f39b19cfad3c4e8178730bd8f0259

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files.exe
MD5
b5e65b9ed68345636843148a8e26ff70

SHA1
330f639268b1f0df4637ab2fed0f0be075b01aee

SHA256
0a58135439cddf79a4cdb3e784b527cc1dcdc663279be398f5291b62144d7695

SHA512
2f5b41748ef3ac0c15af2f20b51fe2794e8159beaafbd1e06444a29c2abff20c909b07e1dea8b9bf8e052b8b7fe8b864ab3f39b19cfad3c4e8178730bd8f0259

Download Submit
C:\Users\Admin\AppData\Local\Temp\Folder.exe
MD5
6f247a83bc3a67c637a5ebe91fde109a

SHA1
827e9e2717e04f5768da944bc87386d03fe8c732

SHA256
1558f756b05cbfd9a303da3129a68cf7aeab568cc58388180d979a785296c7dd

SHA512
845cb5a95fecd0aac13aa4c1e47829ba84d1329ff9c9436d673f97da52a12c6e3c802c65af95d25eaae6f3f008a8fa557df9b95017ee468d72ed7e68d02284f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Folder.exe
MD5
6f247a83bc3a67c637a5ebe91fde109a

SHA1
827e9e2717e04f5768da944bc87386d03fe8c732

SHA256
1558f756b05cbfd9a303da3129a68cf7aeab568cc58388180d979a785296c7dd

SHA512
845cb5a95fecd0aac13aa4c1e47829ba84d1329ff9c9436d673f97da52a12c6e3c802c65af95d25eaae6f3f008a8fa557df9b95017ee468d72ed7e68d02284f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
MD5
cd288343fb831923cb874763d8693b2d

SHA1
919dd350c667890bdc6dcf04580b08a8ace8349b

SHA256
fb0cc84d6dc3ef4b044e008af29659f93781dc27330b4f3f0be4f32be0ea0596

SHA512
637e32da60d6d5d1692fa085936a4353149ad37c1c720fe86c18b6836ed17eee228fffa2bd64a46dcd0aec3047040e789b7f58290b8680c9576f2cb900728418

Download Submit
C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
MD5
cd288343fb831923cb874763d8693b2d

SHA1
919dd350c667890bdc6dcf04580b08a8ace8349b

SHA256
fb0cc84d6dc3ef4b044e008af29659f93781dc27330b4f3f0be4f32be0ea0596

SHA512
637e32da60d6d5d1692fa085936a4353149ad37c1c720fe86c18b6836ed17eee228fffa2bd64a46dcd0aec3047040e789b7f58290b8680c9576f2cb900728418

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
MD5
954264f2ba5b24bbeecb293be714832c

SHA1
fde3ad6e6d8ab951b002c7ca17e867bf3c1d9ba0

SHA256
db5906a6a58c5f7e8991fb5c3a7201843142844650eb5b89bdf89094aba9e96c

SHA512
8fb15e5888d713e10df04b64c0a24250547a978eac9a7b25d653c343f01afc204fa661937a76644a2dcd3f5b65225450d3aaecb67014125a50722df21467ee53

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
MD5
954264f2ba5b24bbeecb293be714832c

SHA1
fde3ad6e6d8ab951b002c7ca17e867bf3c1d9ba0

SHA256
db5906a6a58c5f7e8991fb5c3a7201843142844650eb5b89bdf89094aba9e96c

SHA512
8fb15e5888d713e10df04b64c0a24250547a978eac9a7b25d653c343f01afc204fa661937a76644a2dcd3f5b65225450d3aaecb67014125a50722df21467ee53

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dat
MD5
5a38f117070c9f8aea5bc47895da5d86

SHA1
ee82419e489fe754eb9d93563e14b617b144998a

SHA256
a01473c5af434368d6ace81c3af935fc866c3ab17d8741288b14cb638e511d58

SHA512
17915e7ad849d5143d0eeaa626ff19389914e8cdd93c4cd1d515a0e4683c2f6c5652c88dd2b15dc1631933fed0c85609829db777c2be58af960c0f80737759a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dll
MD5
89c739ae3bbee8c40a52090ad0641d31

SHA1
d0f7dc9a0a3e52af0f9f9736f26e401636c420a1

SHA256
10a122bd647c88aa23f96687e26b251862e83be9dbb89532f4a578689547972d

SHA512
cc5059e478e5f469fde39e4119ee75eed7066f2a2069590cb5046e478b812f87ab1fc21dcfe44c965061fa4f9f83d6a14accf0c0e9b2406ae51504d06a3f6480

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
a6279ec92ff948760ce53bba817d6a77

SHA1
5345505e12f9e4c6d569a226d50e71b5a572dce2

SHA256
8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

SHA512
213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
a6279ec92ff948760ce53bba817d6a77

SHA1
5345505e12f9e4c6d569a226d50e71b5a572dce2

SHA256
8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

SHA512
213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
MD5
0f3560389b1ca2df45c12958c4f1c58e

SHA1
4a6708fba2a99dacf3d727205b97d176abd620ec

SHA256
489e46fa54d173eef788b5a954f2f99157652f506298b551015174ef1e38b005

SHA512
82088189eb4f8d096e6a70e7cec6e948e8950b6a952692869dfad1c597ea30d251b2d8cabf82cf0527b5913beb46de9ed920cb3aaf979536dc75df6dea6a9f35

Download Submit
C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
MD5
0f3560389b1ca2df45c12958c4f1c58e

SHA1
4a6708fba2a99dacf3d727205b97d176abd620ec

SHA256
489e46fa54d173eef788b5a954f2f99157652f506298b551015174ef1e38b005

SHA512
82088189eb4f8d096e6a70e7cec6e948e8950b6a952692869dfad1c597ea30d251b2d8cabf82cf0527b5913beb46de9ed920cb3aaf979536dc75df6dea6a9f35

Download Submit
C:\Users\Admin\AppData\Local\Temp\pub2.exe
MD5
7e6724aeb6582e76a303b0010bdfa60f

SHA1
3a5b4239d4579acedf796a027baf31b6c6ff13f8

SHA256
4675bcb9ece43a3abdf843263479495227672a00d8e9fecc5865b4f0b05a0f04

SHA512
d82bb0ba065c3c30e985a6cc4c57cbd5c84213381cf1c6b6fec516eb5d3a9e56ff7ef2caa04d79eac745bf4a631babbe67ddde0851856f2c8c072f922d01db54

Download Submit
C:\Users\Admin\AppData\Local\Temp\pub2.exe
MD5
7e6724aeb6582e76a303b0010bdfa60f

SHA1
3a5b4239d4579acedf796a027baf31b6c6ff13f8

SHA256
4675bcb9ece43a3abdf843263479495227672a00d8e9fecc5865b4f0b05a0f04

SHA512
d82bb0ba065c3c30e985a6cc4c57cbd5c84213381cf1c6b6fec516eb5d3a9e56ff7ef2caa04d79eac745bf4a631babbe67ddde0851856f2c8c072f922d01db54

Download Submit
C:\Users\Admin\AppData\Local\Temp\pzyh.exe
MD5
ecec67e025fcd37f5d6069b5ff5105ed

SHA1
9a5a0bed2212f47071ad27b28fe407746ecfad18

SHA256
51ac8ea2c6cab10489188133a109aa4507b76ea459996173d0679d542780387c

SHA512
a9d59f137e8688bcee3f1fdc327b41b7f8d836c8e4753e1e9887e03a7c97ecfb851e9d88460f1003970fbaf8638eaa7dd94eb5875a30f51b2c2e7a20a1b51e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\pzyh.exe
MD5
ecec67e025fcd37f5d6069b5ff5105ed

SHA1
9a5a0bed2212f47071ad27b28fe407746ecfad18

SHA256
51ac8ea2c6cab10489188133a109aa4507b76ea459996173d0679d542780387c

SHA512
a9d59f137e8688bcee3f1fdc327b41b7f8d836c8e4753e1e9887e03a7c97ecfb851e9d88460f1003970fbaf8638eaa7dd94eb5875a30f51b2c2e7a20a1b51e33

Download Submit
C:\Users\Public\run.exe
MD5
0dc49df9e15028106239a7bf61c3ff15

SHA1
9baae57c1eda69c861b25cdae3cfabe598ee6fdb

SHA256
b05866c619f548349012ecfed0e192b60c4c07c45548712b4a577130c4b28ef1

SHA512
98d378e2e99db1e673d961bf931d62fd2bcfd34689d9eabc175baaa5e0f27023f7a09f5a777b3e7cc4e37ea4393c84e55b484461c913e2dbf67e25c61bad0ea0

Download Submit
C:\Users\Public\run.exe
MD5
0dc49df9e15028106239a7bf61c3ff15

SHA1
9baae57c1eda69c861b25cdae3cfabe598ee6fdb

SHA256
b05866c619f548349012ecfed0e192b60c4c07c45548712b4a577130c4b28ef1

SHA512
98d378e2e99db1e673d961bf931d62fd2bcfd34689d9eabc175baaa5e0f27023f7a09f5a777b3e7cc4e37ea4393c84e55b484461c913e2dbf67e25c61bad0ea0

Download Submit
C:\Users\Public\run2.exe
MD5
045d25dd957e03248a0d8de26b5381fd

SHA1
df4128ae1a9a37d75522be3507350102bd554151

SHA256
79297c1486c7f3b400d600ecd231b8e0a817bc77c122cdf0a5cac374278a0aec

SHA512
814451461c55f033a5b31265a998c5a0100134d4601cf462a3e019851f1c40983aeeb90e74ab533e8fd0e60d80ea4c8c8cbced22bad5f092eea086d8d8b06f13

Download Submit
C:\Users\Public\run2.exe
MD5
045d25dd957e03248a0d8de26b5381fd

SHA1
df4128ae1a9a37d75522be3507350102bd554151

SHA256
79297c1486c7f3b400d600ecd231b8e0a817bc77c122cdf0a5cac374278a0aec

SHA512
814451461c55f033a5b31265a998c5a0100134d4601cf462a3e019851f1c40983aeeb90e74ab533e8fd0e60d80ea4c8c8cbced22bad5f092eea086d8d8b06f13

Download Submit
C:\Users\Public\run2.exe
MD5
045d25dd957e03248a0d8de26b5381fd

SHA1
df4128ae1a9a37d75522be3507350102bd554151

SHA256
79297c1486c7f3b400d600ecd231b8e0a817bc77c122cdf0a5cac374278a0aec

SHA512
814451461c55f033a5b31265a998c5a0100134d4601cf462a3e019851f1c40983aeeb90e74ab533e8fd0e60d80ea4c8c8cbced22bad5f092eea086d8d8b06f13

Download Submit
\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
\Users\Admin\AppData\LocalLow\nW6mI-7yS1k\freebl3.dll
MD5
60acd24430204ad2dc7f148b8cfe9bdc

SHA1
989f377b9117d7cb21cbe92a4117f88f9c7693d9

SHA256
9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

SHA512
626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

Download Submit
\Users\Admin\AppData\LocalLow\nW6mI-7yS1k\mozglue.dll
MD5
eae9273f8cdcf9321c6c37c244773139

SHA1
8378e2a2f3635574c106eea8419b5eb00b8489b0

SHA256
a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

SHA512
06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

Download Submit
\Users\Admin\AppData\LocalLow\nW6mI-7yS1k\nss3.dll
MD5
02cc7b8ee30056d5912de54f1bdfc219

SHA1
a6923da95705fb81e368ae48f93d28522ef552fb

SHA256
1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

SHA512
0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

Download Submit
\Users\Admin\AppData\LocalLow\nW6mI-7yS1k\softokn3.dll
MD5
4e8df049f3459fa94ab6ad387f3561ac

SHA1
06ed392bc29ad9d5fc05ee254c2625fd65925114

SHA256
25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

SHA512
3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll
MD5
f964811b68f9f1487c2b41e1aef576ce

SHA1
b423959793f14b1416bc3b7051bed58a1034025f

SHA256
83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

SHA512
565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

Download Submit
\Users\Admin\AppData\Local\Temp\CC4F.tmp
MD5
50741b3f2d7debf5d2bed63d88404029

SHA1
56210388a627b926162b36967045be06ffb1aad3

SHA256
f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

SHA512
fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

Download Submit
\Users\Admin\AppData\Local\Temp\axhub.dll
MD5
89c739ae3bbee8c40a52090ad0641d31

SHA1
d0f7dc9a0a3e52af0f9f9736f26e401636c420a1

SHA256
10a122bd647c88aa23f96687e26b251862e83be9dbb89532f4a578689547972d

SHA512
cc5059e478e5f469fde39e4119ee75eed7066f2a2069590cb5046e478b812f87ab1fc21dcfe44c965061fa4f9f83d6a14accf0c0e9b2406ae51504d06a3f6480

Download Submit
memory/64-177-0x0000027322C00000-0x0000027322C71000-memory.dmp

Filesize
452KB

Download
memory/884-182-0x000001AA7D950000-0x000001AA7D9C1000-memory.dmp

Filesize
452KB

Download
memory/884-178-0x000001AA7D890000-0x000001AA7D8DC000-memory.dmp

Filesize
304KB

Download
memory/1044-201-0x0000026E7ECB0000-0x0000026E7ED21000-memory.dmp

Filesize
452KB

Download
memory/1096-195-0x0000025761D60000-0x0000025761DD1000-memory.dmp

Filesize
452KB

Download
memory/1204-223-0x00000143C1F60000-0x00000143C1FD1000-memory.dmp

Filesize
452KB

Download
memory/1248-225-0x00000167FB370000-0x00000167FB3E1000-memory.dmp

Filesize
452KB

Download
memory/1404-217-0x000001930B880000-0x000001930B8F1000-memory.dmp

Filesize
452KB

Download
memory/1848-219-0x000001F5312D0000-0x000001F531341000-memory.dmp

Filesize
452KB

Download
memory/2044-150-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/2044-160-0x0000000005860000-0x0000000005D5E000-memory.dmp

Filesize
5.0MB

Download
memory/2044-135-0x0000000000000000-mapping.dmp

Download
memory/2044-153-0x0000000005D60000-0x0000000005D61000-memory.dmp

Filesize
4KB

Download
memory/2044-155-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/2044-156-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/2324-189-0x000002E654120000-0x000002E654191000-memory.dmp

Filesize
452KB

Download
memory/2352-142-0x0000000000000000-mapping.dmp

Download
memory/2364-183-0x000001FF17DB0000-0x000001FF17E21000-memory.dmp

Filesize
452KB

Download
memory/2428-257-0x0000000000480000-0x0000000000496000-memory.dmp

Filesize
88KB

Download
memory/2584-194-0x00000000024B0000-0x000000000254D000-memory.dmp

Filesize
628KB

Download
memory/2584-202-0x0000000000400000-0x000000000094A000-memory.dmp

Filesize
5.3MB

Download
memory/2584-133-0x0000000000000000-mapping.dmp

Download
memory/2616-227-0x0000022B92270000-0x0000022B922E1000-memory.dmp

Filesize
452KB

Download
memory/2624-229-0x0000025EC1740000-0x0000025EC17B1000-memory.dmp

Filesize
452KB

Download
memory/2632-190-0x000002F435380000-0x000002F4353F1000-memory.dmp

Filesize
452KB

Download
memory/2652-127-0x0000000000000000-mapping.dmp

Download
memory/2692-116-0x0000000000000000-mapping.dmp

Download
memory/2772-126-0x0000000002770000-0x0000000002771000-memory.dmp

Filesize
4KB

Download
memory/2772-132-0x000000001B520000-0x000000001B522000-memory.dmp

Filesize
8KB

Download
memory/2772-130-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/2772-129-0x0000000002780000-0x00000000027A0000-memory.dmp

Filesize
128KB

Download
memory/2772-124-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2772-120-0x0000000000000000-mapping.dmp

Download
memory/2784-143-0x0000000000000000-mapping.dmp

Download
memory/2784-221-0x0000000000400000-0x00000000008F6000-memory.dmp

Filesize
5.0MB

Download
memory/2784-220-0x0000000000A60000-0x0000000000A69000-memory.dmp

Filesize
36KB

Download
memory/3400-239-0x0000000003920000-0x0000000003930000-memory.dmp

Filesize
64KB

Download
memory/3400-139-0x0000000000000000-mapping.dmp

Download
memory/3400-233-0x0000000003780000-0x0000000003790000-memory.dmp

Filesize
64KB

Download
memory/3400-146-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4128-147-0x0000000000000000-mapping.dmp

Download
memory/4300-157-0x0000000000000000-mapping.dmp

Download
memory/4416-176-0x0000000005080000-0x00000000050DD000-memory.dmp

Filesize
372KB

Download
memory/4416-258-0x0000000000000000-mapping.dmp

Download
memory/4416-161-0x0000000000000000-mapping.dmp

Download
memory/4416-174-0x0000000004E87000-0x0000000004F88000-memory.dmp

Filesize
1.0MB

Download
memory/4448-259-0x0000000000000000-mapping.dmp

Download
memory/4544-200-0x0000011916D00000-0x0000011916D71000-memory.dmp

Filesize
452KB

Download
memory/4544-169-0x00007FF634944060-mapping.dmp

Download
memory/4544-267-0x0000011916BC0000-0x0000011916BDB000-memory.dmp

Filesize
108KB

Download
memory/4544-268-0x0000011919500000-0x0000011919606000-memory.dmp

Filesize
1.0MB

Download
memory/4836-230-0x0000000000000000-mapping.dmp

Download
memory/5220-260-0x0000000000000000-mapping.dmp

Download
memory/5232-277-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/5232-275-0x000000000043DC85-mapping.dmp

Download
memory/5632-283-0x0000000000000000-mapping.dmp

Download
memory/5668-284-0x0000000000000000-mapping.dmp

Download
memory/5728-285-0x0000000000000000-mapping.dmp

Download
memory/5728-289-0x0000000000400000-0x000000000094C000-memory.dmp

Filesize
5.3MB

Download
memory/5728-288-0x0000000000950000-0x0000000000A9A000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads