0f16f8428bdf6655be7f22ac1448a3496287340dab3bfde7e9ed221ef920b3ad

General

Target

0f16f8428bdf6655be7f22ac1448a3496287340dab3bfde7e9ed221ef920b3ad.exe
Size

633KB
MD5

106257e4985825ee2d8fb474b5999c9f
SHA1

c73937163cb4016673bdf4de8cbd76e8b2c86b13
SHA256

0f16f8428bdf6655be7f22ac1448a3496287340dab3bfde7e9ed221ef920b3ad
SHA512

0ee6e75b370c672bf5a452ca43457287b32db9db9aaa4c7b17cf287f5da4458133816a6a5454261a463f2254c2ce6f5770ebd2e420680b8fbac7bf978354cc41
SSDEEP

12288:df4gJ24eNaIYW76MjR7SfGqXD8K45JiZcViZX:u4eNVj7hjRM83DiZWi

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

Result.exeÂèðóñ-Steam.exeÂèðóñ.exe

pid process

4944 Result.exe
4344 Âèðóñ-Steam.exe
1756 Âèðóñ.exe

pid	process
4944	Result.exe
4344	Âèðóñ-Steam.exe
1756	Âèðóñ.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0f16f8428bdf6655be7f22ac1448a3496287340dab3bfde7e9ed221ef920b3ad.exeResult.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	0f16f8428bdf6655be7f22ac1448a3496287340dab3bfde7e9ed221ef920b3ad.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Result.exe

Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\362084e0-59c6-4e3f-a990-09d5caf51729.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221127000038.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

Âèðóñ.exeÂèðóñ-Steam.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1756	Âèðóñ.exe
4344	Âèðóñ-Steam.exe
3356	msedge.exe
3356	msedge.exe
32	msedge.exe
32	msedge.exe
1600	identity_helper.exe
1600	identity_helper.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

msedge.exe

pid process

32 msedge.exe
32 msedge.exe
32 msedge.exe
32 msedge.exe
32 msedge.exe

pid	process
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

cmd.exeÂèðóñ.exeÂèðóñ-Steam.exe

description	pid	process
Token: SeSystemtimePrivilege	1696	cmd.exe
Token: SeSystemtimePrivilege	1696	cmd.exe
Token: SeDebugPrivilege	1756	Âèðóñ.exe
Token: SeDebugPrivilege	4344	Âèðóñ-Steam.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msedge.exe

pid process

32 msedge.exe
32 msedge.exe

pid	process
32	msedge.exe
32	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0f16f8428bdf6655be7f22ac1448a3496287340dab3bfde7e9ed221ef920b3ad.exeResult.execmd.exemsedge.exe

description	pid	process	target process
PID 5060 wrote to memory of 4944	5060	0f16f8428bdf6655be7f22ac1448a3496287340dab3bfde7e9ed221ef920b3ad.exe	Result.exe
PID 5060 wrote to memory of 4944	5060	0f16f8428bdf6655be7f22ac1448a3496287340dab3bfde7e9ed221ef920b3ad.exe	Result.exe
PID 5060 wrote to memory of 4944	5060	0f16f8428bdf6655be7f22ac1448a3496287340dab3bfde7e9ed221ef920b3ad.exe	Result.exe
PID 4944 wrote to memory of 4344	4944	Result.exe	Âèðóñ-Steam.exe
PID 4944 wrote to memory of 4344	4944	Result.exe	Âèðóñ-Steam.exe
PID 4944 wrote to memory of 4344	4944	Result.exe	Âèðóñ-Steam.exe
PID 4944 wrote to memory of 1756	4944	Result.exe	Âèðóñ.exe
PID 4944 wrote to memory of 1756	4944	Result.exe	Âèðóñ.exe
PID 4944 wrote to memory of 1756	4944	Result.exe	Âèðóñ.exe
PID 4944 wrote to memory of 1696	4944	Result.exe	cmd.exe
PID 4944 wrote to memory of 1696	4944	Result.exe	cmd.exe
PID 4944 wrote to memory of 1696	4944	Result.exe	cmd.exe
PID 1696 wrote to memory of 32	1696	cmd.exe	msedge.exe
PID 1696 wrote to memory of 32	1696	cmd.exe	msedge.exe
PID 32 wrote to memory of 3448	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 3448	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1972	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 3356	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 3356	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1504	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1504	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1504	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1504	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1504	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 1504	32	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\0f16f8428bdf6655be7f22ac1448a3496287340dab3bfde7e9ed221ef920b3ad.exe
"C:\Users\Admin\AppData\Local\Temp\0f16f8428bdf6655be7f22ac1448a3496287340dab3bfde7e9ed221ef920b3ad.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5060

C:\Users\Admin\AppData\Local\Temp\Result.exe
"C:\Users\Admin\AppData\Local\Temp\Result.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4944

C:\Users\Admin\AppData\Local\Temp\Âèðóñ-Steam.exe
"C:\Users\Admin\AppData\Local\Temp\Âèðóñ-Steam.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Users\Admin\AppData\Local\Temp\Âèðóñ.exe
"C:\Users\Admin\AppData\Local\Temp\Âèðóñ.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Build.bat" "
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://iplogger.ru/1W4m4.jpg
4⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:32

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbab3946f8,0x7ffbab394708,0x7ffbab394718
5⤵
PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,2636363742059816274,9252347127633123816,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
5⤵
PID:1972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,2636363742059816274,9252347127633123816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,2636363742059816274,9252347127633123816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
5⤵
PID:1504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2636363742059816274,9252347127633123816,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
5⤵
PID:3848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2636363742059816274,9252347127633123816,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
5⤵
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2032,2636363742059816274,9252347127633123816,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5252 /prefetch:8
5⤵
PID:4036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2636363742059816274,9252347127633123816,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
5⤵
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2636363742059816274,9252347127633123816,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
5⤵
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2032,2636363742059816274,9252347127633123816,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5532 /prefetch:8
5⤵
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2636363742059816274,9252347127633123816,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
5⤵
PID:4080

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,2636363742059816274,9252347127633123816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6560 /prefetch:8
5⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
5⤵
- Drops file in Program Files directory
PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1c4,0x22c,0x7ff6ae295460,0x7ff6ae295470,0x7ff6ae295480
6⤵
PID:1600

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,2636363742059816274,9252347127633123816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6560 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2032,2636363742059816274,9252347127633123816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3272 /prefetch:8
5⤵
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2032,2636363742059816274,9252347127633123816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5940 /prefetch:8
5⤵
PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2032,2636363742059816274,9252347127633123816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5988 /prefetch:8
5⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2032,2636363742059816274,9252347127633123816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3760 /prefetch:8
5⤵
PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,2636363742059816274,9252347127633123816,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5468 /prefetch:2
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Build.bat
Filesize
76B

MD5
629aa3737ab828c1daafdf9640fb87db

SHA1
d7faccdedb4565617b425ead9bcfdbeb69adb28e

SHA256
66af6a3f595399a501ece86f35cd706afc54fd7aa185996d19f835ce0adfa030

SHA512
d5c61cea9e25c2c3619684e4902db6be9d3d248453f10dfc82fac0207e4b64f8f1ef9ab4ab64b88fa25dd6ac23048357d904bf965f2bcbc82fd49b16a0a3ce38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Result.exe
Filesize
1009KB

MD5
14fcd7a2a5495a7775bb86fff7029caa

SHA1
611957b6f409d8d8dd20f122294d5e2be59847a3

SHA256
9c9755b1d728f5bd5b57e3cfc4eadde041e5ad3d507bf728a20763c838318c13

SHA512
b51e0e152cf8198bc93169fd717d69812cb0588945f893c13c572f4475dab406a32381e7b7798777e784d9b409f94a6eb934db1e54b0d3d0ac2ee40317547633

Download Submit
C:\Users\Admin\AppData\Local\Temp\Result.exe
Filesize
1009KB

MD5
14fcd7a2a5495a7775bb86fff7029caa

SHA1
611957b6f409d8d8dd20f122294d5e2be59847a3

SHA256
9c9755b1d728f5bd5b57e3cfc4eadde041e5ad3d507bf728a20763c838318c13

SHA512
b51e0e152cf8198bc93169fd717d69812cb0588945f893c13c572f4475dab406a32381e7b7798777e784d9b409f94a6eb934db1e54b0d3d0ac2ee40317547633

Download Submit
C:\Users\Admin\AppData\Local\Temp\Âèðóñ-Steam.exe
Filesize
499KB

MD5
58ed1a53c7cf1074def7e0d18d8e9c39

SHA1
a3b828620ae7f83af2fe944a485f6e77ce316237

SHA256
b640b3fea133a236c5eced8985bb3fb0925eb7a22f3b6a6878ecb93a869f2a64

SHA512
45819204ba576983aa1ef56357d1ecefa4939611317e98a85f51913782803f3415ffb3102dc778b31aafaa8a836d819c5453fe128f00f00bcfea923c5af3a3c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Âèðóñ-Steam.exe
Filesize
499KB

MD5
58ed1a53c7cf1074def7e0d18d8e9c39

SHA1
a3b828620ae7f83af2fe944a485f6e77ce316237

SHA256
b640b3fea133a236c5eced8985bb3fb0925eb7a22f3b6a6878ecb93a869f2a64

SHA512
45819204ba576983aa1ef56357d1ecefa4939611317e98a85f51913782803f3415ffb3102dc778b31aafaa8a836d819c5453fe128f00f00bcfea923c5af3a3c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Âèðóñ.exe
Filesize
499KB

MD5
97761fa2232e16b836ffedb45b60c07d

SHA1
af2c706dd04efab73f43850a32a70c5763eb8317

SHA256
f5aee1739022f653cee3108062df3c5deec7a7a884f5a16053f47434abc2dd85

SHA512
2b1e97bbbb7f2bfd762c085afa14bda97d62881fa2cb703d78488897a8bcadb72be4d9fddc665b98979b8f968fb6a97c99f220068223f95c112060d749a7e653

Download Submit
C:\Users\Admin\AppData\Local\Temp\Âèðóñ.exe
Filesize
499KB

MD5
97761fa2232e16b836ffedb45b60c07d

SHA1
af2c706dd04efab73f43850a32a70c5763eb8317

SHA256
f5aee1739022f653cee3108062df3c5deec7a7a884f5a16053f47434abc2dd85

SHA512
2b1e97bbbb7f2bfd762c085afa14bda97d62881fa2cb703d78488897a8bcadb72be4d9fddc665b98979b8f968fb6a97c99f220068223f95c112060d749a7e653

Download Submit
\??\pipe\LOCAL\crashpad_32_YAHDMTRSMSUAIIRF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/32-145-0x0000000000000000-mapping.dmp

Download
memory/1504-155-0x0000000000000000-mapping.dmp

Download
memory/1600-171-0x0000000000000000-mapping.dmp

Download
memory/1600-172-0x0000000000000000-mapping.dmp

Download
memory/1696-141-0x0000000000000000-mapping.dmp

Download
memory/1752-170-0x0000000000000000-mapping.dmp

Download
memory/1756-138-0x0000000000000000-mapping.dmp

Download
memory/1756-143-0x00000000005A0000-0x0000000000622000-memory.dmp

Filesize
520KB

Download
memory/1756-147-0x0000000005AB0000-0x0000000006054000-memory.dmp

Filesize
5.6MB

Download
memory/1756-149-0x00000000055D0000-0x00000000055DA000-memory.dmp

Filesize
40KB

Download
memory/1972-151-0x0000000000000000-mapping.dmp

Download
memory/2280-174-0x0000000000000000-mapping.dmp

Download
memory/2320-176-0x0000000000000000-mapping.dmp

Download
memory/2528-159-0x0000000000000000-mapping.dmp

Download
memory/3356-152-0x0000000000000000-mapping.dmp

Download
memory/3368-181-0x0000000000000000-mapping.dmp

Download
memory/3448-146-0x0000000000000000-mapping.dmp

Download
memory/3848-157-0x0000000000000000-mapping.dmp

Download
memory/4036-161-0x0000000000000000-mapping.dmp

Download
memory/4080-169-0x0000000000000000-mapping.dmp

Download
memory/4344-144-0x0000000000500000-0x0000000000582000-memory.dmp

Filesize
520KB

Download
memory/4344-135-0x0000000000000000-mapping.dmp

Download
memory/4344-148-0x0000000005520000-0x00000000055B2000-memory.dmp

Filesize
584KB

Download
memory/4360-180-0x0000000000000000-mapping.dmp

Download
memory/4476-165-0x0000000000000000-mapping.dmp

Download
memory/4480-167-0x0000000000000000-mapping.dmp

Download
memory/4708-163-0x0000000000000000-mapping.dmp

Download
memory/4868-178-0x0000000000000000-mapping.dmp

Download
memory/4944-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads