Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows11-21h2_x64 -
resource
win11-20231129-en -
resource tags
arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-12-2023 13:43
Static task
static1
Behavioral task
behavioral1
Sample
NXT_SPF.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral2
Sample
NXT_SPF.exe
Resource
win11-20231129-en
General
-
Target
NXT_SPF.exe
-
Size
5.5MB
-
MD5
8173dac88ce0121826ca5c49c0aaa4dd
-
SHA1
08b7de769c28b945a40603cd5a987d00c40df223
-
SHA256
42ffdb67f5ed4b8139165ed5c1852448a8d91f51534807ecd4f760146f694a0b
-
SHA512
fb58f44c06e1aae9614d49eee0b6739f3e0568efb16e98f6f46f0377f319038b586e3565b56394d36c145b5c02e40e3d352fcbd3c48ab40e59b723d3bdcceb49
-
SSDEEP
98304:PmolCB6+AySU2in9TAtcjtIlFqALGaYZ2cTZyolZCdK3ZnC0ZF+eIbBQ5G64vq:OYCXAyzqtU2Fq7gcQsCd6Z5ZFxI9YGhq
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
nxt_spf.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\OkBjxIjTNYnDzYvCDWiyXYaO\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\OkBjxIjTNYnDzYvCDWiyXYaO" nxt_spf.exe -
Executes dropped EXE 6 IoCs
Processes:
nxt_spf.exe icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 4860 nxt_spf.exe 2044 icsys.icn.exe 3880 explorer.exe 4312 spoolsv.exe 232 svchost.exe 236 spoolsv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 5 IoCs
Processes:
spoolsv.exeexplorer.exeNXT_SPF.exeicsys.icn.exedescription ioc process File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe NXT_SPF.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-89531631-1347641568-3714596404-1000\{9AF99FAA-9FDF-4AD1-AF2D-56A150EE7EED} msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
NXT_SPF.exeicsys.icn.exepid process 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 764 NXT_SPF.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 2044 icsys.icn.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 3880 explorer.exe 232 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
nxt_spf.exepid process 4860 nxt_spf.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
WMIC.exenxt_spf.exedescription pid process Token: SeIncreaseQuotaPrivilege 4896 WMIC.exe Token: SeSecurityPrivilege 4896 WMIC.exe Token: SeTakeOwnershipPrivilege 4896 WMIC.exe Token: SeLoadDriverPrivilege 4896 WMIC.exe Token: SeSystemProfilePrivilege 4896 WMIC.exe Token: SeSystemtimePrivilege 4896 WMIC.exe Token: SeProfSingleProcessPrivilege 4896 WMIC.exe Token: SeIncBasePriorityPrivilege 4896 WMIC.exe Token: SeCreatePagefilePrivilege 4896 WMIC.exe Token: SeBackupPrivilege 4896 WMIC.exe Token: SeRestorePrivilege 4896 WMIC.exe Token: SeShutdownPrivilege 4896 WMIC.exe Token: SeDebugPrivilege 4896 WMIC.exe Token: SeSystemEnvironmentPrivilege 4896 WMIC.exe Token: SeRemoteShutdownPrivilege 4896 WMIC.exe Token: SeUndockPrivilege 4896 WMIC.exe Token: SeManageVolumePrivilege 4896 WMIC.exe Token: 33 4896 WMIC.exe Token: 34 4896 WMIC.exe Token: 35 4896 WMIC.exe Token: 36 4896 WMIC.exe Token: SeIncreaseQuotaPrivilege 4896 WMIC.exe Token: SeSecurityPrivilege 4896 WMIC.exe Token: SeTakeOwnershipPrivilege 4896 WMIC.exe Token: SeLoadDriverPrivilege 4896 WMIC.exe Token: SeSystemProfilePrivilege 4896 WMIC.exe Token: SeSystemtimePrivilege 4896 WMIC.exe Token: SeProfSingleProcessPrivilege 4896 WMIC.exe Token: SeIncBasePriorityPrivilege 4896 WMIC.exe Token: SeCreatePagefilePrivilege 4896 WMIC.exe Token: SeBackupPrivilege 4896 WMIC.exe Token: SeRestorePrivilege 4896 WMIC.exe Token: SeShutdownPrivilege 4896 WMIC.exe Token: SeDebugPrivilege 4896 WMIC.exe Token: SeSystemEnvironmentPrivilege 4896 WMIC.exe Token: SeRemoteShutdownPrivilege 4896 WMIC.exe Token: SeUndockPrivilege 4896 WMIC.exe Token: SeManageVolumePrivilege 4896 WMIC.exe Token: 33 4896 WMIC.exe Token: 34 4896 WMIC.exe Token: 35 4896 WMIC.exe Token: 36 4896 WMIC.exe Token: SeLoadDriverPrivilege 4860 nxt_spf.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
msedge.exepid process 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
NXT_SPF.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 764 NXT_SPF.exe 764 NXT_SPF.exe 2044 icsys.icn.exe 2044 icsys.icn.exe 3880 explorer.exe 3880 explorer.exe 4312 spoolsv.exe 4312 spoolsv.exe 232 svchost.exe 232 svchost.exe 236 spoolsv.exe 236 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
NXT_SPF.exeicsys.icn.exeexplorer.exespoolsv.exenxt_spf.exe svchost.execmd.exemsedge.execmd.exedescription pid process target process PID 764 wrote to memory of 4860 764 NXT_SPF.exe nxt_spf.exe PID 764 wrote to memory of 4860 764 NXT_SPF.exe nxt_spf.exe PID 764 wrote to memory of 2044 764 NXT_SPF.exe icsys.icn.exe PID 764 wrote to memory of 2044 764 NXT_SPF.exe icsys.icn.exe PID 764 wrote to memory of 2044 764 NXT_SPF.exe icsys.icn.exe PID 2044 wrote to memory of 3880 2044 icsys.icn.exe explorer.exe PID 2044 wrote to memory of 3880 2044 icsys.icn.exe explorer.exe PID 2044 wrote to memory of 3880 2044 icsys.icn.exe explorer.exe PID 3880 wrote to memory of 4312 3880 explorer.exe spoolsv.exe PID 3880 wrote to memory of 4312 3880 explorer.exe spoolsv.exe PID 3880 wrote to memory of 4312 3880 explorer.exe spoolsv.exe PID 4312 wrote to memory of 232 4312 spoolsv.exe svchost.exe PID 4312 wrote to memory of 232 4312 spoolsv.exe svchost.exe PID 4312 wrote to memory of 232 4312 spoolsv.exe svchost.exe PID 4860 wrote to memory of 456 4860 nxt_spf.exe cmd.exe PID 4860 wrote to memory of 456 4860 nxt_spf.exe cmd.exe PID 232 wrote to memory of 236 232 svchost.exe spoolsv.exe PID 232 wrote to memory of 236 232 svchost.exe spoolsv.exe PID 232 wrote to memory of 236 232 svchost.exe spoolsv.exe PID 456 wrote to memory of 3252 456 cmd.exe msedge.exe PID 456 wrote to memory of 3252 456 cmd.exe msedge.exe PID 3252 wrote to memory of 2992 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 2992 3252 msedge.exe msedge.exe PID 4860 wrote to memory of 3248 4860 nxt_spf.exe cmd.exe PID 4860 wrote to memory of 3248 4860 nxt_spf.exe cmd.exe PID 3248 wrote to memory of 4896 3248 cmd.exe WMIC.exe PID 3248 wrote to memory of 4896 3248 cmd.exe WMIC.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe PID 3252 wrote to memory of 4000 3252 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NXT_SPF.exe"C:\Users\Admin\AppData\Local\Temp\NXT_SPF.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\nxt_spf.exec:\users\admin\appdata\local\temp\nxt_spf.exe2⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start https://discord.gg/cheats3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/cheats4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffafb833cb8,0x7ffafb833cc8,0x7ffafb833cd85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1848 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4456 /prefetch:85⤵
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3540 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,17863833242176978806,7324127390246283716,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1328 /prefetch:25⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic diskdrive get serialnumber3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e3a56ea9c5b0c2dcf785f4a1d4466289
SHA125f8f93ebe18286a649a6ddd068ea8de1f6c4ebf
SHA2567a250350f4e9e23d2c4c8907742fbe0da3c4ecdcbbe7808d0f52ae19d2dd03b6
SHA51248a1fa3388ac41042e8b87c00a966ee771c3c638c1a20c77fb50be692c022fc45dae390a22ae977af99a359aac80e7fa8403c8beec13b974e9269ed40300f017
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD5d41a967e4ba16f826dc7b796f3d7f187
SHA180d92db9ab1e855af7bf8d2e756989dc6221b7f0
SHA2568bc930cb8bbf21f4f942fc39ea1c006e75f1c51928fec87e49463c25ec7b1813
SHA512f36153839afe8044062d39981954916e4b15e730f811d185a92bb3b5aa1fe82b1de4e95608880c2475e1932ea4688dcb019e71795297248da9a067c6e29755a1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
323B
MD5a5a1149047729a493b1a2a65063c39ba
SHA18f1f45cb0c0772dcd05795734cbf408636fb9fb9
SHA256e0ef1f906ea2606c802310437fe799d93e073770ab6549060ee4b9c9c49f2006
SHA5128ce257a087115e2d542657a2b4679d0c100ebdec76e3392cff1bbba133e129f2fcdbd73f9baab92e762bef47a2572d3dc8553fa3858d787d2a0b2bf8f05dc54e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD5302ee50b686849527836f942615cc614
SHA101fd7be23712dc6c54c4b648b3896eaf1413134c
SHA256abfbaeddbe1c4c7e8fcaf533d0db8ea7ce1aa0dfb2fdd8ad2e2cfb146c2e4404
SHA51245e31233480020d559fe067cda76dc5c613ea615101e11504cce73a908f035b1d2717b0c8ae85e6c11a53178b806eecf520d232983d324c4fc70510860e5d943
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5ac7cc7b520058ebd5ae7f0295f79c69f
SHA1746fe395737380ae4fc16e78245df10eb94d336a
SHA2569289fc2c47a3faf245e3405f9677ade4b4c25aa4ee3efc81eec695ad7ae86989
SHA51221a289a6255f11da3b7ab5f5a65a8a9ddc399a0713441995a45c854bdb98b0ccf10d746833a73ae5728bddbb1c695a53c61b678649749bcd190912540936f8dc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
25KB
MD597049f9ab6e2321af46ffb5d97ace24a
SHA1ce76fe72104049775fd5b4e448f736b7240b15c5
SHA256a3b973d13aafde09c894dad7bc3206430a38a870c3f90996fa1fce0c8f2d32a0
SHA51251a0474278c0ef163894d15a80580f55143085165b4f7abc981cf50f4af902973f478cd282baf68c2601040a1620b0978d13b5a36cdf1d00d247b0bd8c304a1f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5c7541cb890c8a2e95e88b05e65c2b7e8
SHA10df6b752bd22cc74e4a2870a5e42bbbca3fdbef5
SHA25615d694b3dc2f495ffdc9a372147df45755efb46579a3eac9b3f6fe2cf3f06d33
SHA5127eb7437d7c8eb33e0c87984bcbf6777609e4c0beb89c25f6dc8e20ad59e43120773ea5585095d67cf9ac7732a43089db986a0ea3a954d9c1b21fb6df90721d65
-
C:\Users\Admin\AppData\Local\Temp\nxt_spf.exeFilesize
5.4MB
MD54d8fa695ca0647cbc886b5caa487b470
SHA1a013b7d4ebc19a216eeafd452513d88705f0203b
SHA256b7cb9b507b3b88dffd39345516c99feb66a7d6370e41ac1c630412abc2eb20d3
SHA5122f770c49dd1f0eb54f7306b0b95f4915a3625cbc02f009003f641c2ba6a9542248b287ee7b731dac1603929d67a6af770a78b5dc2e335c0f030f38eb317ca6e0
-
C:\Windows\Resources\Themes\explorer.exeFilesize
135KB
MD5ca478bedb09b05c5efa92a2bd53e79bc
SHA1ca5b8c82e6fc6c2a90384f2fa0e1ce61ee6fcab7
SHA256a1f2337a846498c890da3b59b3fbc2e9446999ac6fa401cabd38ced6318b11e4
SHA5128061338ab1a037dc3346ab50a3be1cdb52b99fe90dac465523a6346bc91c017b3c1ea64b7b646e7f8e7e5a18ff6233735c53bf4484b4d883f15fe8bde7dfab3c
-
C:\Windows\Resources\Themes\explorer.exeFilesize
135KB
MD5ca478bedb09b05c5efa92a2bd53e79bc
SHA1ca5b8c82e6fc6c2a90384f2fa0e1ce61ee6fcab7
SHA256a1f2337a846498c890da3b59b3fbc2e9446999ac6fa401cabd38ced6318b11e4
SHA5128061338ab1a037dc3346ab50a3be1cdb52b99fe90dac465523a6346bc91c017b3c1ea64b7b646e7f8e7e5a18ff6233735c53bf4484b4d883f15fe8bde7dfab3c
-
C:\Windows\Resources\Themes\icsys.icn.exeFilesize
135KB
MD5eea71a29005afa6eb9447094b6a489ff
SHA1387c6ad8e540bf282e5e87a8f883e2e505d31b81
SHA25612b16cf0e065246e947bb79c726dc28493f0881b884e34e23628f722111c16b9
SHA51226966ca7ca449ec98007e4486766d08efd60186158a647844c9abd40a813d4d5c08333a8dc7a3999ebf57ec96ff04d8c8fe06d695d890daebedf7bbb75da619b
-
C:\Windows\Resources\Themes\icsys.icn.exeFilesize
135KB
MD5eea71a29005afa6eb9447094b6a489ff
SHA1387c6ad8e540bf282e5e87a8f883e2e505d31b81
SHA25612b16cf0e065246e947bb79c726dc28493f0881b884e34e23628f722111c16b9
SHA51226966ca7ca449ec98007e4486766d08efd60186158a647844c9abd40a813d4d5c08333a8dc7a3999ebf57ec96ff04d8c8fe06d695d890daebedf7bbb75da619b
-
C:\Windows\Resources\spoolsv.exeFilesize
135KB
MD5e837e20a99564e23b3f1d4e96934305e
SHA1d60e02f05f01ff81950754ba314b0c8ad9ec1ab5
SHA25655d2650fd11a49f4d9a2173edcff88bfc535b123f448275599bbdcdb4cdfe68f
SHA512db7199c7a3b331f9c824b666cd9f71dec88d42575cdd1c076587c22e14c1d848ba75d4069132248d919a1e0e661d59d8810d9fa28f142d2ed59896edaa93c7f6
-
C:\Windows\Resources\spoolsv.exeFilesize
135KB
MD5e837e20a99564e23b3f1d4e96934305e
SHA1d60e02f05f01ff81950754ba314b0c8ad9ec1ab5
SHA25655d2650fd11a49f4d9a2173edcff88bfc535b123f448275599bbdcdb4cdfe68f
SHA512db7199c7a3b331f9c824b666cd9f71dec88d42575cdd1c076587c22e14c1d848ba75d4069132248d919a1e0e661d59d8810d9fa28f142d2ed59896edaa93c7f6
-
C:\Windows\Resources\svchost.exeFilesize
135KB
MD5dc0abd0c373e383dd696ae94f557d1ea
SHA17ba43bd374df289f51ce59f725583cf1c3254758
SHA256fce6f418dda2b1decbd9332947f5ff966bc762a7e585d645932e3804b09e3b69
SHA512cf9b99c15fb2be01dee15c8e0049f07a145fe53965d4dcbd3002e8ad5463ed6868dd1f25a2c2df0c15f342bef60f5e4be99a7882eecf0491d84c6e7dacd36438
-
\??\c:\users\admin\appdata\local\temp\nxt_spf.exeFilesize
5.4MB
MD54d8fa695ca0647cbc886b5caa487b470
SHA1a013b7d4ebc19a216eeafd452513d88705f0203b
SHA256b7cb9b507b3b88dffd39345516c99feb66a7d6370e41ac1c630412abc2eb20d3
SHA5122f770c49dd1f0eb54f7306b0b95f4915a3625cbc02f009003f641c2ba6a9542248b287ee7b731dac1603929d67a6af770a78b5dc2e335c0f030f38eb317ca6e0
-
\??\c:\windows\resources\spoolsv.exeFilesize
135KB
MD5e837e20a99564e23b3f1d4e96934305e
SHA1d60e02f05f01ff81950754ba314b0c8ad9ec1ab5
SHA25655d2650fd11a49f4d9a2173edcff88bfc535b123f448275599bbdcdb4cdfe68f
SHA512db7199c7a3b331f9c824b666cd9f71dec88d42575cdd1c076587c22e14c1d848ba75d4069132248d919a1e0e661d59d8810d9fa28f142d2ed59896edaa93c7f6
-
\??\c:\windows\resources\svchost.exeFilesize
135KB
MD5dc0abd0c373e383dd696ae94f557d1ea
SHA17ba43bd374df289f51ce59f725583cf1c3254758
SHA256fce6f418dda2b1decbd9332947f5ff966bc762a7e585d645932e3804b09e3b69
SHA512cf9b99c15fb2be01dee15c8e0049f07a145fe53965d4dcbd3002e8ad5463ed6868dd1f25a2c2df0c15f342bef60f5e4be99a7882eecf0491d84c6e7dacd36438
-
\??\c:\windows\resources\themes\explorer.exeFilesize
135KB
MD5ca478bedb09b05c5efa92a2bd53e79bc
SHA1ca5b8c82e6fc6c2a90384f2fa0e1ce61ee6fcab7
SHA256a1f2337a846498c890da3b59b3fbc2e9446999ac6fa401cabd38ced6318b11e4
SHA5128061338ab1a037dc3346ab50a3be1cdb52b99fe90dac465523a6346bc91c017b3c1ea64b7b646e7f8e7e5a18ff6233735c53bf4484b4d883f15fe8bde7dfab3c
-
\??\pipe\LOCAL\crashpad_3252_LMBDXVGCKOZEONTGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/236-49-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/764-0-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/764-52-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2044-51-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2044-11-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4312-50-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4860-86-0x00007FF69F0D0000-0x00007FF69F9AA000-memory.dmpFilesize
8.9MB
-
memory/4860-27-0x00007FFB10070000-0x00007FFB10072000-memory.dmpFilesize
8KB
-
memory/4860-32-0x00007FF69F0D0000-0x00007FF69F9AA000-memory.dmpFilesize
8.9MB
-
memory/4860-31-0x00007FF69F0D0000-0x00007FF69F9AA000-memory.dmpFilesize
8.9MB