agenttesla | hxxps://cdn[.]discordapp[.]com/attachments/1168956975988613260/1183160794377113621/xd[.]rar?ex=6587535b&is=6574de5b&hm=ab8d1c35775ee7d2b678a4942d0ea0b94fb5a3bf0e9ccf003a79b056271567fa&

Analysis

max time kernel
1686s
max time network
1159s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2023 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1168956975988613260/1183160794377113621/xd.rar?ex=6587535b&is=6574de5b&hm=ab8d1c35775ee7d2b678a4942d0ea0b94fb5a3bf0e9ccf003a79b056271567fa&

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 4 IoCs

resource	yara_rule
behavioral1/files/0x000700000002323d-211.dat	family_agenttesla
behavioral1/files/0x000700000002323d-213.dat	family_agenttesla
behavioral1/files/0x000700000002323d-212.dat	family_agenttesla
behavioral1/memory/6048-214-0x00000000057A0000-0x00000000059B4000-memory.dmp	family_agenttesla

Downloads MZ/PE file

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hlOPGuhzeqNCeoHRgQrPhcX\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\hlOPGuhzeqNCeoHRgQrPhcX"	mapper.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Control Panel\International\Geo\Nation	SubZero.exe

Executes dropped EXE 3 IoCs

pid	Process
6048	SubZero.exe
1484	mapper.exe
5924	mapper.exe

Loads dropped DLL 2 IoCs

pid	Process
6048	SubZero.exe
6048	SubZero.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\driver.sys	SubZero.exe
File created	C:\Windows\mapper.exe	SubZero.exe
File opened for modification	C:\Windows\driver.sys	SubZero.exe
File opened for modification	C:\Windows\mapper.exe	SubZero.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SubZero.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SubZero.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	SubZero.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3420	msedge.exe
3420	msedge.exe
3236	msedge.exe
3236	msedge.exe
3032	identity_helper.exe
3032	identity_helper.exe
1884	msedge.exe
1884	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5128	7zFM.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
5924	mapper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5128	7zFM.exe
Token: 35	5128	7zFM.exe
Token: SeSecurityPrivilege	5128	7zFM.exe
Token: SeIncreaseQuotaPrivilege	4844	WMIC.exe
Token: SeSecurityPrivilege	4844	WMIC.exe
Token: SeTakeOwnershipPrivilege	4844	WMIC.exe
Token: SeLoadDriverPrivilege	4844	WMIC.exe
Token: SeSystemProfilePrivilege	4844	WMIC.exe
Token: SeSystemtimePrivilege	4844	WMIC.exe
Token: SeProfSingleProcessPrivilege	4844	WMIC.exe
Token: SeIncBasePriorityPrivilege	4844	WMIC.exe
Token: SeCreatePagefilePrivilege	4844	WMIC.exe
Token: SeBackupPrivilege	4844	WMIC.exe
Token: SeRestorePrivilege	4844	WMIC.exe
Token: SeShutdownPrivilege	4844	WMIC.exe
Token: SeDebugPrivilege	4844	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4844	WMIC.exe
Token: SeRemoteShutdownPrivilege	4844	WMIC.exe
Token: SeUndockPrivilege	4844	WMIC.exe
Token: SeManageVolumePrivilege	4844	WMIC.exe
Token: 33	4844	WMIC.exe
Token: 34	4844	WMIC.exe
Token: 35	4844	WMIC.exe
Token: 36	4844	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4844	WMIC.exe
Token: SeSecurityPrivilege	4844	WMIC.exe
Token: SeTakeOwnershipPrivilege	4844	WMIC.exe
Token: SeLoadDriverPrivilege	4844	WMIC.exe
Token: SeSystemProfilePrivilege	4844	WMIC.exe
Token: SeSystemtimePrivilege	4844	WMIC.exe
Token: SeProfSingleProcessPrivilege	4844	WMIC.exe
Token: SeIncBasePriorityPrivilege	4844	WMIC.exe
Token: SeCreatePagefilePrivilege	4844	WMIC.exe
Token: SeBackupPrivilege	4844	WMIC.exe
Token: SeRestorePrivilege	4844	WMIC.exe
Token: SeShutdownPrivilege	4844	WMIC.exe
Token: SeDebugPrivilege	4844	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4844	WMIC.exe
Token: SeRemoteShutdownPrivilege	4844	WMIC.exe
Token: SeUndockPrivilege	4844	WMIC.exe
Token: SeManageVolumePrivilege	4844	WMIC.exe
Token: 33	4844	WMIC.exe
Token: 34	4844	WMIC.exe
Token: 35	4844	WMIC.exe
Token: 36	4844	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5512	WMIC.exe
Token: SeSecurityPrivilege	5512	WMIC.exe
Token: SeTakeOwnershipPrivilege	5512	WMIC.exe
Token: SeLoadDriverPrivilege	5512	WMIC.exe
Token: SeSystemProfilePrivilege	5512	WMIC.exe
Token: SeSystemtimePrivilege	5512	WMIC.exe
Token: SeProfSingleProcessPrivilege	5512	WMIC.exe
Token: SeIncBasePriorityPrivilege	5512	WMIC.exe
Token: SeCreatePagefilePrivilege	5512	WMIC.exe
Token: SeBackupPrivilege	5512	WMIC.exe
Token: SeRestorePrivilege	5512	WMIC.exe
Token: SeShutdownPrivilege	5512	WMIC.exe
Token: SeDebugPrivilege	5512	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5512	WMIC.exe
Token: SeRemoteShutdownPrivilege	5512	WMIC.exe
Token: SeUndockPrivilege	5512	WMIC.exe
Token: SeManageVolumePrivilege	5512	WMIC.exe
Token: 33	5512	WMIC.exe
Token: 34	5512	WMIC.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
5128	7zFM.exe
5128	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 4836	3236	msedge.exe	87
PID 3236 wrote to memory of 4836	3236	msedge.exe	87
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3828	3236	msedge.exe	88
PID 3236 wrote to memory of 3420	3236	msedge.exe	89
PID 3236 wrote to memory of 3420	3236	msedge.exe	89
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90
PID 3236 wrote to memory of 408	3236	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1168956975988613260/1183160794377113621/xd.rar?ex=6587535b&is=6574de5b&hm=ab8d1c35775ee7d2b678a4942d0ea0b94fb5a3bf0e9ccf003a79b056271567fa&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9681f46f8,0x7ff9681f4708,0x7ff9681f4718
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,7015295006177907905,7462547779588179823,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,7015295006177907905,7462547779588179823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,7015295006177907905,7462547779588179823,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7015295006177907905,7462547779588179823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7015295006177907905,7462547779588179823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,7015295006177907905,7462547779588179823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,7015295006177907905,7462547779588179823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7015295006177907905,7462547779588179823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2236,7015295006177907905,7462547779588179823,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2236,7015295006177907905,7462547779588179823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7015295006177907905,7462547779588179823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2236,7015295006177907905,7462547779588179823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7015295006177907905,7462547779588179823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7015295006177907905,7462547779588179823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7015295006177907905,7462547779588179823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,7015295006177907905,7462547779588179823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2328 /prefetch:1
  2⤵
  PID:5436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:808

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5104

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5656

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\xd.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Serial_Checker(1).bat" "
1⤵
PID:2604
- C:\Windows\system32\mode.com
  mode con: cols=180 lines=62
  2⤵
  PID:5920
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4844
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5512
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:5556
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Description,PNPDeviceID
  2⤵
  PID:5452
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:764
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  PID:5712
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get processorid
  2⤵
  PID:5936
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
  2⤵
  PID:3544

C:\Users\Admin\Desktop\SubZero.exe
"C:\Users\Admin\Desktop\SubZero.exe" C:\Users\Admin\Desktop\Guna.UI2.dll
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
PID:6048
- C:\Windows\mapper.exe
  "C:\Windows\mapper.exe" C:\Windows\driver2.sys
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\mapper.exe
  "C:\Windows\mapper.exe" C:\Windows\driver.sys
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  PID:5924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Serial_Checker(1).bat" "
1⤵
PID:4728
- C:\Windows\system32\mode.com
  mode con: cols=180 lines=62
  2⤵
  PID:4524
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:2080
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:2996
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:552
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Description,PNPDeviceID
  2⤵
  PID:5092
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:4252
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  PID:2332
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get processorid
  2⤵
  PID:408
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
  2⤵
  PID:2872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Serial_Checker(1).bat" "
1⤵
PID:1004
- C:\Windows\system32\mode.com
  mode con: cols=180 lines=62
  2⤵
  PID:5408
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:5608
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:2232
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:5620
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Description,PNPDeviceID
  2⤵
  PID:3300
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  PID:2076
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  PID:5652
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get processorid
  2⤵
  PID:5128
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
  2⤵
  PID:3184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e5c27b4a4d5a3c9c60ba18cb867266e3

SHA1
dea55f1d4cdc831f943f4e56f4f8e9a926777600

SHA256
860ed0acc83eb0096cc8911725e2c631ff879ad8c35854577651af502c4b69c9

SHA512
56eda28e9c61e8081dadc220d23e7bb3320a9ba557eb7511d17a3d2836aa61f301d1d714a3d611eedd7c4b91886c790af7366b01acdb3b637f3dc4fb024f3f6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6a19675a6195cd411d311d2c7939e425

SHA1
2940118821ab383e0dfe80dcf4b691135a18028a

SHA256
6ca5a7c4896c5d0366d7d3aa72c85909e38995931b567233f1a9322f7fc20498

SHA512
2816ae0d67de8edc1d8d01fe2986a50a6b91ab39a9118933bed65a7a8d15d8384f71a7ce89be1f4f8001d6545fb43cd12a8b733b7832503b64003cba40b7e6c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
32fdcbac89f424e793ab15d330e0e6fe

SHA1
a8ce787f8b2667c3f732d4eee3cc97296da43e09

SHA256
1847c4484797b706d46a06c39d477af473dc3f9c8ca1c56792520dafa2b0ab44

SHA512
9d1c975ea6cf7ffc3482c60bf8133a9b4597bd017a30470939c20ca2933a805522a3cbf05041254fa7bc50d47c68117eff56d2514586c440d8c23df9e9a08977

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7ddf12ac1c1fb3aff7b18200096b9d3f

SHA1
8efda6debf34feebfe8237509378e05b764bc81c

SHA256
4067701403c8025ab0ef873d172084c899f19c3b54fdddf6285630b2d5cfddbf

SHA512
3201603ffe681f182521facba2f75aa30dbb99474e47cc6055a6d3512bf91324ab8c02568a7a606b86a5c4604534b5a5c8f82c7da24fcb2b6430273f5759dd62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e30738d93d6789672ce8e1c4bfe275a8

SHA1
ce2195ec1f2e3830b9a106a9dc8d7fa5397d10fc

SHA256
7d60046d1238ff11bdf616d83c212ad6866a7cc630ee9be8580050dee7f74832

SHA512
e39c9590f558477a1b823de555bf27542a725566d8bd839a1c493459444d49d755445d8ff34f59681ede12a8e654c5a7fc34b6008c9abcfd65d09f6b1b523a65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6f4f0b8efac1186b68ddb10af89e03fd

SHA1
ce8222f67aae1c61c8978668616eaa7959c5b168

SHA256
bed148cdcce8409a295b4756891420075cc69fb2c7f724eaeb07d5c0f6bf34f6

SHA512
83b8f311386503167a75af118a1d2360d544baf23ce49597d4be43a1fa237779cf5246f395102ead4e181f28d31b980d04548da8a9d8500c18cd9fdccba969dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
55931940195478c36c8a1b62ea4fdf37

SHA1
c262a002e6d763e42c10db347dec50a78c945fee

SHA256
4b00b03f7edba5528d6fec365f953c5b435dad50565c92836d8442bd024ee6ce

SHA512
37e52b71e1daf3f40e912c19c3b27af06646885bde3ddd57f4f5fa9b7985a4b6d5cf9883599f4d3473980f5da520aca8e773162a22a91c936093863a48cba7e5

Download Submit
C:\Users\Admin\Desktop\Guna.UI2.dll

Filesize
2.1MB

MD5
c19e9e6a4bc1b668d19505a0437e7f7e

SHA1
73be712aef4baa6e9dabfc237b5c039f62a847fa

SHA256
9ac8b65e5c13292a8e564187c1e7446adc4230228b669383bd7b07035ab99a82

SHA512
b6cd0af436459f35a97db2d928120c53d3691533b01e4f0e8b382f2bd81d9a9a2c57e5e2aa6ade9d6a1746d5c4b2ef6c88d3a0cf519424b34445d0d30aab61de

Download Submit
C:\Users\Admin\Desktop\Guna.UI2.dll

Filesize
2.1MB

MD5
c19e9e6a4bc1b668d19505a0437e7f7e

SHA1
73be712aef4baa6e9dabfc237b5c039f62a847fa

SHA256
9ac8b65e5c13292a8e564187c1e7446adc4230228b669383bd7b07035ab99a82

SHA512
b6cd0af436459f35a97db2d928120c53d3691533b01e4f0e8b382f2bd81d9a9a2c57e5e2aa6ade9d6a1746d5c4b2ef6c88d3a0cf519424b34445d0d30aab61de

Download Submit
C:\Users\Admin\Desktop\Guna.UI2.dll

Filesize
2.1MB

MD5
c19e9e6a4bc1b668d19505a0437e7f7e

SHA1
73be712aef4baa6e9dabfc237b5c039f62a847fa

SHA256
9ac8b65e5c13292a8e564187c1e7446adc4230228b669383bd7b07035ab99a82

SHA512
b6cd0af436459f35a97db2d928120c53d3691533b01e4f0e8b382f2bd81d9a9a2c57e5e2aa6ade9d6a1746d5c4b2ef6c88d3a0cf519424b34445d0d30aab61de

Download Submit
C:\Users\Admin\Desktop\Serial_Checker(1).bat

Filesize
856B

MD5
03d75cc61bf080fd17aa6918012b41f1

SHA1
8cc3c6261ef2fedba9e9775c5f52c4df80a50c40

SHA256
ad9cf673846217f19ed64fa3c451f985d692b39b899889f71befb01f6c871541

SHA512
8521fd2ef6d7aab3aa85b586a8b6e2149639bed24580c4fbc891bc9b6bdd81209cce2d4ca1140ee61778c4e1bc96c27e2979d236501402546b29c131d3465e46

Download Submit
C:\Users\Admin\Desktop\SubZero.exe

Filesize
319KB

MD5
5a61563e97a4e56c6870a00db97988eb

SHA1
57232a44231784491c5c5b275d0b6107cd831f98

SHA256
ff96a31b316b7ace965bc78842f2bf1f7dd7c91edc19533c5d259814cb75ca40

SHA512
a88fd3b775ffded2730aac41b92e2a1d2a23c2fb9c2ccaf004cc6d82ede98bc96191ecefed5f055c30746c66af367559a3ed2544d31e5d61fd55f7ab8c0bd33f

Download Submit
C:\Users\Admin\Desktop\SubZero.exe

Filesize
319KB

MD5
5a61563e97a4e56c6870a00db97988eb

SHA1
57232a44231784491c5c5b275d0b6107cd831f98

SHA256
ff96a31b316b7ace965bc78842f2bf1f7dd7c91edc19533c5d259814cb75ca40

SHA512
a88fd3b775ffded2730aac41b92e2a1d2a23c2fb9c2ccaf004cc6d82ede98bc96191ecefed5f055c30746c66af367559a3ed2544d31e5d61fd55f7ab8c0bd33f

Download Submit
C:\Users\Admin\Downloads\xd.rar

Filesize
836KB

MD5
8815b0efedce569cbfc6a63a7bd792bd

SHA1
e97e730c73999974639d5754d92b7bea27e6fbf3

SHA256
82eb9198579b6ea236b80dd0982bab6f2975431e3474e72642c4b82e3004106f

SHA512
a89e78fda8adfd9d24011b307e66c68cb860450192261af5e9468a6754227c5b5ff487f8809da79eed27227be36d3b5c135e05f02f0f5df9323e2abaac7c5c8e

Download Submit
C:\Users\Admin\Downloads\xd.rar

Filesize
836KB

MD5
8815b0efedce569cbfc6a63a7bd792bd

SHA1
e97e730c73999974639d5754d92b7bea27e6fbf3

SHA256
82eb9198579b6ea236b80dd0982bab6f2975431e3474e72642c4b82e3004106f

SHA512
a89e78fda8adfd9d24011b307e66c68cb860450192261af5e9468a6754227c5b5ff487f8809da79eed27227be36d3b5c135e05f02f0f5df9323e2abaac7c5c8e

Download Submit
C:\Windows\mapper.exe

Filesize
140KB

MD5
04263de7ee19c3b84c3c144e98672bc2

SHA1
1aa0f179e18958de411952b620ad5ddf168c2bf4

SHA256
8aefceadb8116935252bcc2875a61a728a3f6068da5a0c12bf50ed309316d2dd

SHA512
fd2b70ca7f5ede587140e1be6df785fe271c26b7beeff5da0096dc529fde4dfaf6835fef93a6e252898b60af94ef07a08fa7fdeb3530d95222e44cbc96bac6c7

Download Submit
C:\Windows\mapper.exe

Filesize
140KB

MD5
04263de7ee19c3b84c3c144e98672bc2

SHA1
1aa0f179e18958de411952b620ad5ddf168c2bf4

SHA256
8aefceadb8116935252bcc2875a61a728a3f6068da5a0c12bf50ed309316d2dd

SHA512
fd2b70ca7f5ede587140e1be6df785fe271c26b7beeff5da0096dc529fde4dfaf6835fef93a6e252898b60af94ef07a08fa7fdeb3530d95222e44cbc96bac6c7

Download Submit
C:\Windows\mapper.exe

Filesize
140KB

MD5
04263de7ee19c3b84c3c144e98672bc2

SHA1
1aa0f179e18958de411952b620ad5ddf168c2bf4

SHA256
8aefceadb8116935252bcc2875a61a728a3f6068da5a0c12bf50ed309316d2dd

SHA512
fd2b70ca7f5ede587140e1be6df785fe271c26b7beeff5da0096dc529fde4dfaf6835fef93a6e252898b60af94ef07a08fa7fdeb3530d95222e44cbc96bac6c7

Download Submit
C:\Windows\mapper.exe

Filesize
140KB

MD5
04263de7ee19c3b84c3c144e98672bc2

SHA1
1aa0f179e18958de411952b620ad5ddf168c2bf4

SHA256
8aefceadb8116935252bcc2875a61a728a3f6068da5a0c12bf50ed309316d2dd

SHA512
fd2b70ca7f5ede587140e1be6df785fe271c26b7beeff5da0096dc529fde4dfaf6835fef93a6e252898b60af94ef07a08fa7fdeb3530d95222e44cbc96bac6c7

Download Submit
C:\Windows\mapper.exe

Filesize
140KB

MD5
04263de7ee19c3b84c3c144e98672bc2

SHA1
1aa0f179e18958de411952b620ad5ddf168c2bf4

SHA256
8aefceadb8116935252bcc2875a61a728a3f6068da5a0c12bf50ed309316d2dd

SHA512
fd2b70ca7f5ede587140e1be6df785fe271c26b7beeff5da0096dc529fde4dfaf6835fef93a6e252898b60af94ef07a08fa7fdeb3530d95222e44cbc96bac6c7

Download Submit
memory/6048-206-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/6048-214-0x00000000057A0000-0x00000000059B4000-memory.dmp

Filesize
2.1MB

Download
memory/6048-215-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/6048-205-0x0000000000190000-0x00000000001E6000-memory.dmp

Filesize
344KB

Download
memory/6048-208-0x0000000004C40000-0x0000000004CD2000-memory.dmp

Filesize
584KB

Download
memory/6048-207-0x00000000051F0000-0x0000000005794000-memory.dmp

Filesize
5.6MB

Download
memory/6048-210-0x0000000004BE0000-0x0000000004BEA000-memory.dmp

Filesize
40KB

Download
memory/6048-209-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/6048-236-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/6048-237-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/6048-238-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download