42ffdb67f5ed4b8139165ed5c1852448a8d91f51534807ecd4f760146f694a0b

Analysis

max time kernel
150s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20231129-en
resource tags

arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system
submitted
07-12-2023 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NXT_SPF.exe
Size

5.5MB
MD5

8173dac88ce0121826ca5c49c0aaa4dd
SHA1

08b7de769c28b945a40603cd5a987d00c40df223
SHA256

42ffdb67f5ed4b8139165ed5c1852448a8d91f51534807ecd4f760146f694a0b
SHA512

fb58f44c06e1aae9614d49eee0b6739f3e0568efb16e98f6f46f0377f319038b586e3565b56394d36c145b5c02e40e3d352fcbd3c48ab40e59b723d3bdcceb49
SSDEEP

98304:PmolCB6+AySU2in9TAtcjtIlFqALGaYZ2cTZyolZCdK3ZnC0ZF+eIbBQ5G64vq:OYCXAyzqtU2Fq7gcQsCd6Z5ZFxI9YGhq

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

nxt_spf.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\OkBjxIjTNYnDzYvCDWiyXYaO\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\OkBjxIjTNYnDzYvCDWiyXYaO"	nxt_spf.exe

Executes dropped EXE 6 IoCs

Processes:

nxt_spf.exe icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

4860 nxt_spf.exe
2044 icsys.icn.exe
3880 explorer.exe
4312 spoolsv.exe
232 svchost.exe
236 spoolsv.exe

pid	process
4860	nxt_spf.exe
2044	icsys.icn.exe
3880	explorer.exe
4312	spoolsv.exe
232	svchost.exe
236	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 2 IoCs

Processes:

explorer.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

Processes:

spoolsv.exeexplorer.exeNXT_SPF.exeicsys.icn.exe

description	ioc	process
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	NXT_SPF.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-89531631-1347641568-3714596404-1000\{9AF99FAA-9FDF-4AD1-AF2D-56A150EE7EED}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

NXT_SPF.exeicsys.icn.exe

pid	process
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
764	NXT_SPF.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
2044	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

3880 explorer.exe
232 svchost.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

nxt_spf.exe

pid process

4860 nxt_spf.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3252 msedge.exe
3252 msedge.exe
3252 msedge.exe
3252 msedge.exe
3252 msedge.exe
3252 msedge.exe
3252 msedge.exe

pid	process
3880	explorer.exe
232	svchost.exe

pid	process
4860	nxt_spf.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

WMIC.exenxt_spf.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4896	WMIC.exe
Token: SeSecurityPrivilege	4896	WMIC.exe
Token: SeTakeOwnershipPrivilege	4896	WMIC.exe
Token: SeLoadDriverPrivilege	4896	WMIC.exe
Token: SeSystemProfilePrivilege	4896	WMIC.exe
Token: SeSystemtimePrivilege	4896	WMIC.exe
Token: SeProfSingleProcessPrivilege	4896	WMIC.exe
Token: SeIncBasePriorityPrivilege	4896	WMIC.exe
Token: SeCreatePagefilePrivilege	4896	WMIC.exe
Token: SeBackupPrivilege	4896	WMIC.exe
Token: SeRestorePrivilege	4896	WMIC.exe
Token: SeShutdownPrivilege	4896	WMIC.exe
Token: SeDebugPrivilege	4896	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4896	WMIC.exe
Token: SeRemoteShutdownPrivilege	4896	WMIC.exe
Token: SeUndockPrivilege	4896	WMIC.exe
Token: SeManageVolumePrivilege	4896	WMIC.exe
Token: 33	4896	WMIC.exe
Token: 34	4896	WMIC.exe
Token: 35	4896	WMIC.exe
Token: 36	4896	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4896	WMIC.exe
Token: SeSecurityPrivilege	4896	WMIC.exe
Token: SeTakeOwnershipPrivilege	4896	WMIC.exe
Token: SeLoadDriverPrivilege	4896	WMIC.exe
Token: SeSystemProfilePrivilege	4896	WMIC.exe
Token: SeSystemtimePrivilege	4896	WMIC.exe
Token: SeProfSingleProcessPrivilege	4896	WMIC.exe
Token: SeIncBasePriorityPrivilege	4896	WMIC.exe
Token: SeCreatePagefilePrivilege	4896	WMIC.exe
Token: SeBackupPrivilege	4896	WMIC.exe
Token: SeRestorePrivilege	4896	WMIC.exe
Token: SeShutdownPrivilege	4896	WMIC.exe
Token: SeDebugPrivilege	4896	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4896	WMIC.exe
Token: SeRemoteShutdownPrivilege	4896	WMIC.exe
Token: SeUndockPrivilege	4896	WMIC.exe
Token: SeManageVolumePrivilege	4896	WMIC.exe
Token: 33	4896	WMIC.exe
Token: 34	4896	WMIC.exe
Token: 35	4896	WMIC.exe
Token: 36	4896	WMIC.exe
Token: SeLoadDriverPrivilege	4860	nxt_spf.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

NXT_SPF.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
764	NXT_SPF.exe
764	NXT_SPF.exe
2044	icsys.icn.exe
2044	icsys.icn.exe
3880	explorer.exe
3880	explorer.exe
4312	spoolsv.exe
4312	spoolsv.exe
232	svchost.exe
232	svchost.exe
236	spoolsv.exe
236	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

NXT_SPF.exeicsys.icn.exeexplorer.exespoolsv.exenxt_spf.exe svchost.execmd.exemsedge.execmd.exe

description	pid	process	target process
PID 764 wrote to memory of 4860	764	NXT_SPF.exe	nxt_spf.exe
PID 764 wrote to memory of 4860	764	NXT_SPF.exe	nxt_spf.exe
PID 764 wrote to memory of 2044	764	NXT_SPF.exe	icsys.icn.exe
PID 764 wrote to memory of 2044	764	NXT_SPF.exe	icsys.icn.exe
PID 764 wrote to memory of 2044	764	NXT_SPF.exe	icsys.icn.exe
PID 2044 wrote to memory of 3880	2044	icsys.icn.exe	explorer.exe
PID 2044 wrote to memory of 3880	2044	icsys.icn.exe	explorer.exe
PID 2044 wrote to memory of 3880	2044	icsys.icn.exe	explorer.exe
PID 3880 wrote to memory of 4312	3880	explorer.exe	spoolsv.exe
PID 3880 wrote to memory of 4312	3880	explorer.exe	spoolsv.exe
PID 3880 wrote to memory of 4312	3880	explorer.exe	spoolsv.exe
PID 4312 wrote to memory of 232	4312	spoolsv.exe	svchost.exe
PID 4312 wrote to memory of 232	4312	spoolsv.exe	svchost.exe
PID 4312 wrote to memory of 232	4312	spoolsv.exe	svchost.exe
PID 4860 wrote to memory of 456	4860	nxt_spf.exe	cmd.exe
PID 4860 wrote to memory of 456	4860	nxt_spf.exe	cmd.exe
PID 232 wrote to memory of 236	232	svchost.exe	spoolsv.exe
PID 232 wrote to memory of 236	232	svchost.exe	spoolsv.exe
PID 232 wrote to memory of 236	232	svchost.exe	spoolsv.exe
PID 456 wrote to memory of 3252	456	cmd.exe	msedge.exe
PID 456 wrote to memory of 3252	456	cmd.exe	msedge.exe
PID 3252 wrote to memory of 2992	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 2992	3252	msedge.exe	msedge.exe
PID 4860 wrote to memory of 3248	4860	nxt_spf.exe	cmd.exe
PID 4860 wrote to memory of 3248	4860	nxt_spf.exe	cmd.exe
PID 3248 wrote to memory of 4896	3248	cmd.exe	WMIC.exe
PID 3248 wrote to memory of 4896	3248	cmd.exe	WMIC.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe
PID 3252 wrote to memory of 4000	3252	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\NXT_SPF.exe
"C:\Users\Admin\AppData\Local\Temp\NXT_SPF.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764

\??\c:\users\admin\appdata\local\temp\nxt_spf.exe
c:\users\admin\appdata\local\temp\nxt_spf.exe
2⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start https://discord.gg/cheats
3⤵
- Suspicious use of WriteProcessMemory
PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/cheats
4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffafb833cb8,0x7ffafb833cc8,0x7ffafb833cd8
5⤵
PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1848 /prefetch:2
5⤵
PID:4000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
5⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
5⤵
PID:3808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
5⤵
PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
5⤵
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
5⤵
PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4456 /prefetch:8
5⤵
- Modifies registry class
PID:1484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3540 /prefetch:8
5⤵
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
5⤵
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
5⤵
PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
5⤵
PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
5⤵
PID:788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
5⤵
PID:1140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
5⤵
PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1328 /prefetch:2
5⤵
PID:756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic diskdrive get serialnumber
3⤵
- Suspicious use of WriteProcessMemory
PID:3248

C:\Windows\System32\Wbem\WMIC.exe
wmic diskdrive get serialnumber
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Windows\Resources\Themes\icsys.icn.exe
C:\Windows\Resources\Themes\icsys.icn.exe
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044

\??\c:\windows\resources\themes\explorer.exe
c:\windows\resources\themes\explorer.exe
3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3880

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe SE
4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312

\??\c:\windows\resources\svchost.exe
c:\windows\resources\svchost.exe
5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:232

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe PR
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1468

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e3a56ea9c5b0c2dcf785f4a1d4466289

SHA1
25f8f93ebe18286a649a6ddd068ea8de1f6c4ebf

SHA256
7a250350f4e9e23d2c4c8907742fbe0da3c4ecdcbbe7808d0f52ae19d2dd03b6

SHA512
48a1fa3388ac41042e8b87c00a966ee771c3c638c1a20c77fb50be692c022fc45dae390a22ae977af99a359aac80e7fa8403c8beec13b974e9269ed40300f017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
d41a967e4ba16f826dc7b796f3d7f187

SHA1
80d92db9ab1e855af7bf8d2e756989dc6221b7f0

SHA256
8bc930cb8bbf21f4f942fc39ea1c006e75f1c51928fec87e49463c25ec7b1813

SHA512
f36153839afe8044062d39981954916e4b15e730f811d185a92bb3b5aa1fe82b1de4e95608880c2475e1932ea4688dcb019e71795297248da9a067c6e29755a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
323B

MD5
a5a1149047729a493b1a2a65063c39ba

SHA1
8f1f45cb0c0772dcd05795734cbf408636fb9fb9

SHA256
e0ef1f906ea2606c802310437fe799d93e073770ab6549060ee4b9c9c49f2006

SHA512
8ce257a087115e2d542657a2b4679d0c100ebdec76e3392cff1bbba133e129f2fcdbd73f9baab92e762bef47a2572d3dc8553fa3858d787d2a0b2bf8f05dc54e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
302ee50b686849527836f942615cc614

SHA1
01fd7be23712dc6c54c4b648b3896eaf1413134c

SHA256
abfbaeddbe1c4c7e8fcaf533d0db8ea7ce1aa0dfb2fdd8ad2e2cfb146c2e4404

SHA512
45e31233480020d559fe067cda76dc5c613ea615101e11504cce73a908f035b1d2717b0c8ae85e6c11a53178b806eecf520d232983d324c4fc70510860e5d943

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
ac7cc7b520058ebd5ae7f0295f79c69f

SHA1
746fe395737380ae4fc16e78245df10eb94d336a

SHA256
9289fc2c47a3faf245e3405f9677ade4b4c25aa4ee3efc81eec695ad7ae86989

SHA512
21a289a6255f11da3b7ab5f5a65a8a9ddc399a0713441995a45c854bdb98b0ccf10d746833a73ae5728bddbb1c695a53c61b678649749bcd190912540936f8dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
25KB

MD5
97049f9ab6e2321af46ffb5d97ace24a

SHA1
ce76fe72104049775fd5b4e448f736b7240b15c5

SHA256
a3b973d13aafde09c894dad7bc3206430a38a870c3f90996fa1fce0c8f2d32a0

SHA512
51a0474278c0ef163894d15a80580f55143085165b4f7abc981cf50f4af902973f478cd282baf68c2601040a1620b0978d13b5a36cdf1d00d247b0bd8c304a1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
c7541cb890c8a2e95e88b05e65c2b7e8

SHA1
0df6b752bd22cc74e4a2870a5e42bbbca3fdbef5

SHA256
15d694b3dc2f495ffdc9a372147df45755efb46579a3eac9b3f6fe2cf3f06d33

SHA512
7eb7437d7c8eb33e0c87984bcbf6777609e4c0beb89c25f6dc8e20ad59e43120773ea5585095d67cf9ac7732a43089db986a0ea3a954d9c1b21fb6df90721d65

Download Submit
C:\Users\Admin\AppData\Local\Temp\nxt_spf.exe
Filesize
5.4MB

MD5
4d8fa695ca0647cbc886b5caa487b470

SHA1
a013b7d4ebc19a216eeafd452513d88705f0203b

SHA256
b7cb9b507b3b88dffd39345516c99feb66a7d6370e41ac1c630412abc2eb20d3

SHA512
2f770c49dd1f0eb54f7306b0b95f4915a3625cbc02f009003f641c2ba6a9542248b287ee7b731dac1603929d67a6af770a78b5dc2e335c0f030f38eb317ca6e0

Download Submit
C:\Windows\Resources\Themes\explorer.exe
Filesize
135KB

MD5
ca478bedb09b05c5efa92a2bd53e79bc

SHA1
ca5b8c82e6fc6c2a90384f2fa0e1ce61ee6fcab7

SHA256
a1f2337a846498c890da3b59b3fbc2e9446999ac6fa401cabd38ced6318b11e4

SHA512
8061338ab1a037dc3346ab50a3be1cdb52b99fe90dac465523a6346bc91c017b3c1ea64b7b646e7f8e7e5a18ff6233735c53bf4484b4d883f15fe8bde7dfab3c

Download Submit
C:\Windows\Resources\Themes\explorer.exe
Filesize
135KB

MD5
ca478bedb09b05c5efa92a2bd53e79bc

SHA1
ca5b8c82e6fc6c2a90384f2fa0e1ce61ee6fcab7

SHA256
a1f2337a846498c890da3b59b3fbc2e9446999ac6fa401cabd38ced6318b11e4

SHA512
8061338ab1a037dc3346ab50a3be1cdb52b99fe90dac465523a6346bc91c017b3c1ea64b7b646e7f8e7e5a18ff6233735c53bf4484b4d883f15fe8bde7dfab3c

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe
Filesize
135KB

MD5
eea71a29005afa6eb9447094b6a489ff

SHA1
387c6ad8e540bf282e5e87a8f883e2e505d31b81

SHA256
12b16cf0e065246e947bb79c726dc28493f0881b884e34e23628f722111c16b9

SHA512
26966ca7ca449ec98007e4486766d08efd60186158a647844c9abd40a813d4d5c08333a8dc7a3999ebf57ec96ff04d8c8fe06d695d890daebedf7bbb75da619b

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe
Filesize
135KB

MD5
eea71a29005afa6eb9447094b6a489ff

SHA1
387c6ad8e540bf282e5e87a8f883e2e505d31b81

SHA256
12b16cf0e065246e947bb79c726dc28493f0881b884e34e23628f722111c16b9

SHA512
26966ca7ca449ec98007e4486766d08efd60186158a647844c9abd40a813d4d5c08333a8dc7a3999ebf57ec96ff04d8c8fe06d695d890daebedf7bbb75da619b

Download Submit
C:\Windows\Resources\spoolsv.exe
Filesize
135KB

MD5
e837e20a99564e23b3f1d4e96934305e

SHA1
d60e02f05f01ff81950754ba314b0c8ad9ec1ab5

SHA256
55d2650fd11a49f4d9a2173edcff88bfc535b123f448275599bbdcdb4cdfe68f

SHA512
db7199c7a3b331f9c824b666cd9f71dec88d42575cdd1c076587c22e14c1d848ba75d4069132248d919a1e0e661d59d8810d9fa28f142d2ed59896edaa93c7f6

Download Submit
C:\Windows\Resources\spoolsv.exe
Filesize
135KB

MD5
e837e20a99564e23b3f1d4e96934305e

SHA1
d60e02f05f01ff81950754ba314b0c8ad9ec1ab5

SHA256
55d2650fd11a49f4d9a2173edcff88bfc535b123f448275599bbdcdb4cdfe68f

SHA512
db7199c7a3b331f9c824b666cd9f71dec88d42575cdd1c076587c22e14c1d848ba75d4069132248d919a1e0e661d59d8810d9fa28f142d2ed59896edaa93c7f6

Download Submit
C:\Windows\Resources\svchost.exe
Filesize
135KB

MD5
dc0abd0c373e383dd696ae94f557d1ea

SHA1
7ba43bd374df289f51ce59f725583cf1c3254758

SHA256
fce6f418dda2b1decbd9332947f5ff966bc762a7e585d645932e3804b09e3b69

SHA512
cf9b99c15fb2be01dee15c8e0049f07a145fe53965d4dcbd3002e8ad5463ed6868dd1f25a2c2df0c15f342bef60f5e4be99a7882eecf0491d84c6e7dacd36438

Download Submit
\??\c:\users\admin\appdata\local\temp\nxt_spf.exe
Filesize
5.4MB

MD5
4d8fa695ca0647cbc886b5caa487b470

SHA1
a013b7d4ebc19a216eeafd452513d88705f0203b

SHA256
b7cb9b507b3b88dffd39345516c99feb66a7d6370e41ac1c630412abc2eb20d3

SHA512
2f770c49dd1f0eb54f7306b0b95f4915a3625cbc02f009003f641c2ba6a9542248b287ee7b731dac1603929d67a6af770a78b5dc2e335c0f030f38eb317ca6e0

Download Submit
\??\c:\windows\resources\spoolsv.exe
Filesize
135KB

MD5
e837e20a99564e23b3f1d4e96934305e

SHA1
d60e02f05f01ff81950754ba314b0c8ad9ec1ab5

SHA256
55d2650fd11a49f4d9a2173edcff88bfc535b123f448275599bbdcdb4cdfe68f

SHA512
db7199c7a3b331f9c824b666cd9f71dec88d42575cdd1c076587c22e14c1d848ba75d4069132248d919a1e0e661d59d8810d9fa28f142d2ed59896edaa93c7f6

Download Submit
\??\c:\windows\resources\svchost.exe
Filesize
135KB

MD5
dc0abd0c373e383dd696ae94f557d1ea

SHA1
7ba43bd374df289f51ce59f725583cf1c3254758

SHA256
fce6f418dda2b1decbd9332947f5ff966bc762a7e585d645932e3804b09e3b69

SHA512
cf9b99c15fb2be01dee15c8e0049f07a145fe53965d4dcbd3002e8ad5463ed6868dd1f25a2c2df0c15f342bef60f5e4be99a7882eecf0491d84c6e7dacd36438

Download Submit
\??\c:\windows\resources\themes\explorer.exe
Filesize
135KB

MD5
ca478bedb09b05c5efa92a2bd53e79bc

SHA1
ca5b8c82e6fc6c2a90384f2fa0e1ce61ee6fcab7

SHA256
a1f2337a846498c890da3b59b3fbc2e9446999ac6fa401cabd38ced6318b11e4

SHA512
8061338ab1a037dc3346ab50a3be1cdb52b99fe90dac465523a6346bc91c017b3c1ea64b7b646e7f8e7e5a18ff6233735c53bf4484b4d883f15fe8bde7dfab3c

Download Submit
\??\pipe\LOCAL\crashpad_3252_LMBDXVGCKOZEONTG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/236-49-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/764-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/764-52-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2044-51-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2044-11-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4312-50-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4860-86-0x00007FF69F0D0000-0x00007FF69F9AA000-memory.dmp

Filesize
8.9MB

Download
memory/4860-27-0x00007FFB10070000-0x00007FFB10072000-memory.dmp

Filesize
8KB

Download
memory/4860-32-0x00007FF69F0D0000-0x00007FF69F9AA000-memory.dmp

Filesize
8.9MB

Download
memory/4860-31-0x00007FF69F0D0000-0x00007FF69F9AA000-memory.dmp

Filesize
8.9MB

Download