f71fbe54ec60dc2c19ca7a7d1ee06a2b134c216e32228ddb76217a64b452011c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2022 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

peachjars - Linkvertise Downloader_kT33-41.exe
Size

4.3MB
MD5

bf244845092d9973e7a5a93635080267
SHA1

3e5d24552e8b5881a794479faa9cd7e48f09d219
SHA256

f71fbe54ec60dc2c19ca7a7d1ee06a2b134c216e32228ddb76217a64b452011c
SHA512

fc81d20d8d24ca997c5cd1a3f171934a022aa318ecd978c7ede01a4e1cd3d3fa5384d3edc9c4dd3e6cb88cf82a6d66d3db7fd5b96a4af5aad83f2c393a3eea49
SSDEEP

98304:xSie6hoXOWZ3lsuUxqxgWph7NLx137O5z:/oXOM1ughx7Sz

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5040	peachjars - Linkvertise Downloader_kT33-41.tmp

Loads dropped DLL 4 IoCs

pid	Process
5040	peachjars - Linkvertise Downloader_kT33-41.tmp
5040	peachjars - Linkvertise Downloader_kT33-41.tmp
5040	peachjars - Linkvertise Downloader_kT33-41.tmp
5040	peachjars - Linkvertise Downloader_kT33-41.tmp

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\d48aa8b0-4e55-41c2-bb98-4c1243ab6f16.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220925000657.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	peachjars - Linkvertise Downloader_kT33-41.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	peachjars - Linkvertise Downloader_kT33-41.tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	13	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
5092	msedge.exe
5092	msedge.exe
3856	identity_helper.exe
3856	identity_helper.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe
6056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2760	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2760	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5040	peachjars - Linkvertise Downloader_kT33-41.tmp
5092	msedge.exe
5092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 5040	3400	peachjars - Linkvertise Downloader_kT33-41.exe	81
PID 3400 wrote to memory of 5040	3400	peachjars - Linkvertise Downloader_kT33-41.exe	81
PID 3400 wrote to memory of 5040	3400	peachjars - Linkvertise Downloader_kT33-41.exe	81
PID 5040 wrote to memory of 5092	5040	peachjars - Linkvertise Downloader_kT33-41.tmp	82
PID 5040 wrote to memory of 5092	5040	peachjars - Linkvertise Downloader_kT33-41.tmp	82
PID 5092 wrote to memory of 4016	5092	msedge.exe	83
PID 5092 wrote to memory of 4016	5092	msedge.exe	83
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4576	5092	msedge.exe	86
PID 5092 wrote to memory of 4136	5092	msedge.exe	87
PID 5092 wrote to memory of 4136	5092	msedge.exe	87
PID 5092 wrote to memory of 4864	5092	msedge.exe	88
PID 5092 wrote to memory of 4864	5092	msedge.exe	88
PID 5092 wrote to memory of 4864	5092	msedge.exe	88
PID 5092 wrote to memory of 4864	5092	msedge.exe	88
PID 5092 wrote to memory of 4864	5092	msedge.exe	88
PID 5092 wrote to memory of 4864	5092	msedge.exe	88
PID 5092 wrote to memory of 4864	5092	msedge.exe	88
PID 5092 wrote to memory of 4864	5092	msedge.exe	88
PID 5092 wrote to memory of 4864	5092	msedge.exe	88
PID 5092 wrote to memory of 4864	5092	msedge.exe	88
PID 5092 wrote to memory of 4864	5092	msedge.exe	88
PID 5092 wrote to memory of 4864	5092	msedge.exe	88
PID 5092 wrote to memory of 4864	5092	msedge.exe	88
PID 5092 wrote to memory of 4864	5092	msedge.exe	88
PID 5092 wrote to memory of 4864	5092	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\peachjars - Linkvertise Downloader_kT33-41.exe
"C:\Users\Admin\AppData\Local\Temp\peachjars - Linkvertise Downloader_kT33-41.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Users\Admin\AppData\Local\Temp\is-CAAIQ.tmp\peachjars - Linkvertise Downloader_kT33-41.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-CAAIQ.tmp\peachjars - Linkvertise Downloader_kT33-41.tmp" /SL5="$8003A,3525439,1235456,C:\Users\Admin\AppData\Local\Temp\peachjars - Linkvertise Downloader_kT33-41.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/folder/RZZgkKZY#ePhPVBRTv0j3jMF8fI6F6w
    3⤵
    - Adds Run key to start application
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe997a46f8,0x7ffe997a4708,0x7ffe997a4718
      4⤵
      PID:4016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5284 /prefetch:8
      4⤵
      PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5588 /prefetch:8
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:8
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:1720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7caf55460,0x7ff7caf55470,0x7ff7caf55480
        5⤵
        
        PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6064 /prefetch:8
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
      4⤵
      PID:2108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
      4⤵
      PID:5476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
      4⤵
      PID:5548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2780 /prefetch:1
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4056 /prefetch:8
      4⤵
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5660 /prefetch:8
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,2381995688224169368,10570258665305727847,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3996 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x31c 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-8L2ID.tmp\AppUtils.dll

Filesize
1.8MB

MD5
43ce6d593abd5141a3139603f352ae05

SHA1
a97c75e23d275dddfde15ef5fdf3ff3253c0992c

SHA256
94e874f2702ea6be50e7d74864b66e7f763449c3db237803f3fad6adfd64ed3d

SHA512
bfc527529e5f73ba190dfc5bd043175c7e2ae963b665d6d39421c29e025020f1d593dc88b7bee33d86ef6b4f7a4c5e1a0339df4e99cab6849a275d1dda9f439f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8L2ID.tmp\DimensionUtils.dll

Filesize
1.9MB

MD5
ce2dc2cc12aec529511da19cf63ba802

SHA1
5b45c33a34df73920077f546176a3aa96df0f80e

SHA256
bde7cc0193ad2fbdfa9f072d9003bf1c82cd27e027b2e038343514f8cc8ee6d2

SHA512
98b5017e437b05639238b63bdf6cccdea7665f3fa0c55e87e8c7139551c213b1a63d641d588b950346ec66bb03b4800dc4e3dd4c60f80e0e76779b1ba58d2be7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8L2ID.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8L2ID.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CAAIQ.tmp\peachjars - Linkvertise Downloader_kT33-41.tmp

Filesize
3.4MB

MD5
06e087e48e6d73efd7f353855aacb570

SHA1
679e2a92aa2c8a09fa3b615d56e48667ff8bb4f8

SHA256
9a0815e309db4d6feebf90ce5e91cc78892b2016dcbe07fd436afd655477320d

SHA512
05e4fe70aa104a4edbbdddf5e7396446d67123e2865c3a02c414a39c1ee6dc34aba6fa6f587435755a9a90ade1b7eccefe0e76244563689e0971a024049086c2

Download Submit
memory/828-156-0x0000000000000000-mapping.dmp

Download
memory/1112-166-0x0000000000000000-mapping.dmp

Download
memory/1720-160-0x0000000000000000-mapping.dmp

Download
memory/2108-168-0x0000000000000000-mapping.dmp

Download
memory/2252-164-0x0000000000000000-mapping.dmp

Download
memory/2632-158-0x0000000000000000-mapping.dmp

Download
memory/3400-136-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/3400-143-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/3400-132-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/3564-154-0x0000000000000000-mapping.dmp

Download
memory/3856-162-0x0000000000000000-mapping.dmp

Download
memory/4016-144-0x0000000000000000-mapping.dmp

Download
memory/4136-147-0x0000000000000000-mapping.dmp

Download
memory/4304-152-0x0000000000000000-mapping.dmp

Download
memory/4576-146-0x0000000000000000-mapping.dmp

Download
memory/4708-161-0x0000000000000000-mapping.dmp

Download
memory/4864-150-0x0000000000000000-mapping.dmp

Download
memory/5040-134-0x0000000000000000-mapping.dmp

Download
memory/5040-140-0x0000000005690000-0x000000000569F000-memory.dmp

Filesize
60KB

Download
memory/5092-142-0x0000000000000000-mapping.dmp

Download
memory/5476-170-0x0000000000000000-mapping.dmp

Download
memory/5548-172-0x0000000000000000-mapping.dmp

Download
memory/5632-174-0x0000000000000000-mapping.dmp

Download
memory/5780-176-0x0000000000000000-mapping.dmp

Download
memory/5928-178-0x0000000000000000-mapping.dmp

Download
memory/6004-180-0x0000000000000000-mapping.dmp

Download
memory/6056-181-0x0000000000000000-mapping.dmp

Download