Overview
overview
10Static
static
7Executable...ce.url
windows10-2004-x64
1Executable...rd.url
windows10-2004-x64
1Executable...on.url
windows10-2004-x64
1Executable...um.url
windows10-2004-x64
1Executable...ub.url
windows10-2004-x64
1Executable...te.url
windows10-2004-x64
1Executable...e).url
windows10-2004-x64
1Executable...ub.url
windows10-2004-x64
1Executable...er.cmd
windows10-2004-x64
10Executable...TI.cmd
windows10-2004-x64
1Executable...vc.cmd
windows10-2004-x64
10Executable...ev.cmd
windows10-2004-x64
10Executable...er.exe
windows10-2004-x64
3Executable...ce.exe
windows10-2004-x64
7Executable...P1.cmd
windows10-2004-x64
1Executable...P2.cmd
windows10-2004-x64
1Executable...RS.cmd
windows10-2004-x64
1Executable...OP.cmd
windows10-2004-x64
1Executable...NP.ps1
windows10-2004-x64
1Executables/EDGE.cmd
windows10-2004-x64
1Executable...ZE.cmd
windows10-2004-x64
6Executable...PT.ps1
windows10-2004-x64
1Executables/ONED.cmd
windows10-2004-x64
1Executables/PFP.cmd
windows10-2004-x64
1Executables/POWER.cmd
windows10-2004-x64
1Executable...NU.cmd
windows10-2004-x64
4Executable...TH.cmd
windows10-2004-x64
1Executable...ER.cmd
windows10-2004-x64
4Executable...00.png
windows10-2004-x64
3Executable...rk.png
windows10-2004-x64
3Executable...ht.png
windows10-2004-x64
3playbook.xml
windows10-2004-x64
1Resubmissions
25-04-2023 20:18
230425-y3j7yscg23 10Analysis
-
max time kernel
499s -
max time network
506s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2023 20:18
Behavioral task
behavioral1
Sample
Executables/Atlas/4. Troubleshooting/Visual C++ Redistributables/Visual C++ Redistributables AIO Source.url
Resource
win10v2004-20230221-en
Behavioral task
behavioral2
Sample
Executables/Atlas/Atlas Discord.url
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Executables/Atlas/Atlas Documentation.url
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
Executables/Atlas/Atlas Forum.url
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Executables/Atlas/Atlas GitHub.url
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
Executables/Atlas/Atlas Website.url
Resource
win10v2004-20230221-en
Behavioral task
behavioral7
Sample
Executables/AtlasModules/Acknowledgements/Atlas Utilities (filepicker & multichoice).url
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
Executables/AtlasModules/Acknowledgements/setSvc GitHub.url
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Executables/AtlasModules/Scripts/Auto-Cleaner.cmd
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
Executables/AtlasModules/Scripts/RunAsTI.cmd
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
Executables/AtlasModules/Scripts/setSvc.cmd
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
Executables/AtlasModules/Scripts/toggleDev.cmd
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Executables/AtlasModules/Tools/filepicker.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
Executables/AtlasModules/Tools/multichoice.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
Executables/BACKUP1.cmd
Resource
win10v2004-20230221-en
Behavioral task
behavioral16
Sample
Executables/BACKUP2.cmd
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Executables/CONVERTUSERS.cmd
Resource
win10v2004-20230220-en
Behavioral task
behavioral18
Sample
Executables/COPYDESKTOP.cmd
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Executables/DISABLEPNP.ps1
Resource
win10v2004-20230220-en
Behavioral task
behavioral20
Sample
Executables/EDGE.cmd
Resource
win10v2004-20230221-en
Behavioral task
behavioral21
Sample
Executables/FINALIZE.cmd
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
Executables/MITIGATIONPROMPT.ps1
Resource
win10v2004-20230221-en
Behavioral task
behavioral23
Sample
Executables/ONED.cmd
Resource
win10v2004-20230221-en
Behavioral task
behavioral24
Sample
Executables/PFP.cmd
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
Executables/POWER.cmd
Resource
win10v2004-20230220-en
Behavioral task
behavioral26
Sample
Executables/STARTMENU.cmd
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
Executables/UPDHEALTH.cmd
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
Executables/WALLPAPER.cmd
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
Executables/Web/Screen/img100.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral30
Sample
Executables/Web/Wallpaper/Windows/atlas-dark.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
Executables/Web/Wallpaper/Windows/atlas-light.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral32
Sample
playbook.xml
Resource
win10v2004-20230220-en
General
-
Target
Executables/EDGE.cmd
-
Size
2KB
-
MD5
f72816519ebf6d36a20f81757a4e7c84
-
SHA1
a414269462f5e1336f93d491573ac74c5d0aee42
-
SHA256
950bb700b28e6fc95131219315658a6edcbef6abf23243f0099f0539ed6f8901
-
SHA512
936215e7a92a76a8dd4b3c904781760965713e941c27f5c657045c5a959d954b6e0aa4acef20037c15005c40c06a3740823fb679f967872f53d78f6f06b47646
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4220 wrote to memory of 2124 4220 cmd.exe 82 PID 4220 wrote to memory of 2124 4220 cmd.exe 82 PID 2124 wrote to memory of 2352 2124 cmd.exe 83 PID 2124 wrote to memory of 2352 2124 cmd.exe 83 PID 2124 wrote to memory of 2036 2124 cmd.exe 84 PID 2124 wrote to memory of 2036 2124 cmd.exe 84 PID 4220 wrote to memory of 4572 4220 cmd.exe 85 PID 4220 wrote to memory of 4572 4220 cmd.exe 85 PID 4220 wrote to memory of 4240 4220 cmd.exe 86 PID 4220 wrote to memory of 4240 4220 cmd.exe 86 PID 4220 wrote to memory of 1684 4220 cmd.exe 88 PID 4220 wrote to memory of 1684 4220 cmd.exe 88 PID 4220 wrote to memory of 4956 4220 cmd.exe 87 PID 4220 wrote to memory of 4956 4220 cmd.exe 87 PID 4220 wrote to memory of 2004 4220 cmd.exe 89 PID 4220 wrote to memory of 2004 4220 cmd.exe 89 PID 4220 wrote to memory of 2060 4220 cmd.exe 90 PID 4220 wrote to memory of 2060 4220 cmd.exe 90 PID 4220 wrote to memory of 1216 4220 cmd.exe 91 PID 4220 wrote to memory of 1216 4220 cmd.exe 91 PID 1216 wrote to memory of 3156 1216 cmd.exe 92 PID 1216 wrote to memory of 3156 1216 cmd.exe 92 PID 1216 wrote to memory of 4636 1216 cmd.exe 93 PID 1216 wrote to memory of 4636 1216 cmd.exe 93 PID 4220 wrote to memory of 4940 4220 cmd.exe 94 PID 4220 wrote to memory of 4940 4220 cmd.exe 94 PID 4220 wrote to memory of 3608 4220 cmd.exe 95 PID 4220 wrote to memory of 3608 4220 cmd.exe 95 PID 4220 wrote to memory of 3048 4220 cmd.exe 96 PID 4220 wrote to memory of 3048 4220 cmd.exe 96 PID 4220 wrote to memory of 3372 4220 cmd.exe 97 PID 4220 wrote to memory of 3372 4220 cmd.exe 97 PID 4220 wrote to memory of 1548 4220 cmd.exe 98 PID 4220 wrote to memory of 1548 4220 cmd.exe 98 PID 1548 wrote to memory of 4592 1548 cmd.exe 99 PID 1548 wrote to memory of 4592 1548 cmd.exe 99 PID 1548 wrote to memory of 2740 1548 cmd.exe 100 PID 1548 wrote to memory of 2740 1548 cmd.exe 100 PID 4220 wrote to memory of 3812 4220 cmd.exe 101 PID 4220 wrote to memory of 3812 4220 cmd.exe 101 PID 4220 wrote to memory of 4428 4220 cmd.exe 102 PID 4220 wrote to memory of 4428 4220 cmd.exe 102 PID 4220 wrote to memory of 3096 4220 cmd.exe 103 PID 4220 wrote to memory of 3096 4220 cmd.exe 103 PID 4220 wrote to memory of 4124 4220 cmd.exe 104 PID 4220 wrote to memory of 4124 4220 cmd.exe 104 PID 4220 wrote to memory of 5036 4220 cmd.exe 105 PID 4220 wrote to memory of 5036 4220 cmd.exe 105 PID 4220 wrote to memory of 2040 4220 cmd.exe 106 PID 4220 wrote to memory of 2040 4220 cmd.exe 106 PID 4220 wrote to memory of 5012 4220 cmd.exe 107 PID 4220 wrote to memory of 5012 4220 cmd.exe 107 PID 5012 wrote to memory of 208 5012 cmd.exe 109 PID 5012 wrote to memory of 208 5012 cmd.exe 109 PID 5012 wrote to memory of 3044 5012 cmd.exe 108 PID 5012 wrote to memory of 3044 5012 cmd.exe 108 PID 4220 wrote to memory of 4516 4220 cmd.exe 110 PID 4220 wrote to memory of 4516 4220 cmd.exe 110 PID 4220 wrote to memory of 2668 4220 cmd.exe 111 PID 4220 wrote to memory of 2668 4220 cmd.exe 111 PID 4220 wrote to memory of 3736 4220 cmd.exe 113 PID 4220 wrote to memory of 3736 4220 cmd.exe 113 PID 4220 wrote to memory of 3664 4220 cmd.exe 112 PID 4220 wrote to memory of 3664 4220 cmd.exe 112
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Executables\EDGE.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKEY_USERS" | findstr /r /x /c:"HKEY_USERS\\S-.*" /c:"HKEY_USERS\\AME_UserHive_[^_]*"2⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\system32\reg.exereg query "HKEY_USERS"3⤵PID:2352
-
-
C:\Windows\system32\findstr.exefindstr /r /x /c:"HKEY_USERS\\S-.*" /c:"HKEY_USERS\\AME_UserHive_[^_]*"3⤵PID:2036
-
-
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-19"2⤵PID:4572
-
-
C:\Windows\system32\findstr.exefindstr /c:"Volatile Environment" /c:"AME_UserHive_"2⤵PID:4240
-
-
C:\Windows\system32\findstr.exefindstr /c:"Volatile Environment" /c:"AME_UserHive_"2⤵PID:4956
-
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-20"2⤵PID:1684
-
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-21-2805025096-2326403612-4231045514-1000"2⤵PID:2004
-
-
C:\Windows\system32\findstr.exefindstr /c:"Volatile Environment" /c:"AME_UserHive_"2⤵PID:2060
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKU\\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "AppData" | findstr /r /x /c:".*AppData[ ]*REG_SZ[ ].*"2⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\system32\reg.exereg query "HKU\\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "AppData"3⤵PID:3156
-
-
C:\Windows\system32\findstr.exefindstr /r /x /c:".*AppData[ ]*REG_SZ[ ].*"3⤵PID:4636
-
-
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes"2⤵PID:4940
-
-
C:\Windows\system32\findstr.exefindstr /c:"Volatile Environment" /c:"AME_UserHive_"2⤵PID:3608
-
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-18"2⤵PID:3048
-
-
C:\Windows\system32\findstr.exefindstr /c:"Volatile Environment" /c:"AME_UserHive_"2⤵PID:3372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKEY_USERS" | findstr /c:"S-"2⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\system32\reg.exereg query "HKEY_USERS"3⤵PID:4592
-
-
C:\Windows\system32\findstr.exefindstr /c:"S-"3⤵PID:2740
-
-
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-19"2⤵PID:3812
-
-
C:\Windows\system32\findstr.exefindstr /c:"Volatile Environment" /c:"AME_UserHive_"2⤵PID:4428
-
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-20"2⤵PID:3096
-
-
C:\Windows\system32\findstr.exefindstr /c:"Volatile Environment" /c:"AME_UserHive_"2⤵PID:4124
-
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-21-2805025096-2326403612-4231045514-1000"2⤵PID:5036
-
-
C:\Windows\system32\findstr.exefindstr /c:"Volatile Environment" /c:"AME_UserHive_"2⤵PID:2040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKU\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" | findstr /i /c:"MicrosoftEdge" /c:"msedge"2⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\system32\findstr.exefindstr /i /c:"MicrosoftEdge" /c:"msedge"3⤵PID:3044
-
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"3⤵PID:208
-
-
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes"2⤵PID:4516
-
-
C:\Windows\system32\findstr.exefindstr /c:"Volatile Environment" /c:"AME_UserHive_"2⤵PID:2668
-
-
C:\Windows\system32\findstr.exefindstr /c:"Volatile Environment" /c:"AME_UserHive_"2⤵PID:3664
-
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-18"2⤵PID:3736
-