57dfbec9f672e54a5a94510033c1c98d78bffbf02ec4b9e777b216bc81d25ade

Analysis

max time kernel
269s
max time network
270s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
20/02/2024, 16:17

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

USSR_Flags.rbxm
Size

8KB
MD5

ab5b228073d68545e7674dc2154b2f12
SHA1

5461218b1aa83a3ef423b508dddc152e47bb439c
SHA256

57dfbec9f672e54a5a94510033c1c98d78bffbf02ec4b9e777b216bc81d25ade
SHA512

c2e5cd4dfb3b1f2f13b1667f4b22c7e0258b437d428bae1ae3938cd66b06357d36dcb59032e9a971ca97bb7724432d1e21b9d7a5741808b03194e9c786f586be
SSDEEP

192:fkNsEJpsAaqePEEfCGAHD31E5Wy6MLbhcdbv8CMigs:LETsA6E2jAHDFaWKyp0ogs

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP"	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,22000,282"	unregmp2.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "213"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}\ = "Open Media Sharing Handler"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-3404610768-3912631216-307532709-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-3404610768-3912631216-307532709-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-3404610768-3912631216-307532709-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\ShellEx\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2076	msedge.exe
2076	msedge.exe
1012	msedge.exe
1012	msedge.exe
1172	identity_helper.exe
1172	identity_helper.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3972	taskmgr.exe
Token: SeSystemProfilePrivilege	3972	taskmgr.exe
Token: SeCreateGlobalPrivilege	3972	taskmgr.exe
Token: 33	3972	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3972	taskmgr.exe
Token: SeShutdownPrivilege	4268	unregmp2.exe
Token: SeCreatePagefilePrivilege	4268	unregmp2.exe
Token: SeShutdownPrivilege	2072	wmplayer.exe
Token: SeCreatePagefilePrivilege	2072	wmplayer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe
3972	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3468	OpenWith.exe
1900	OpenWith.exe
2320	MiniSearchHost.exe
1612	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 908	2076	msedge.exe	87
PID 2076 wrote to memory of 908	2076	msedge.exe	87
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 4560	2076	msedge.exe	88
PID 2076 wrote to memory of 2260	2076	msedge.exe	89
PID 2076 wrote to memory of 2260	2076	msedge.exe	89
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90
PID 2076 wrote to memory of 3052	2076	msedge.exe	90

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\USSR_Flags.rbxm
1⤵
- Modifies registry class
PID:4824

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffd4683cb8,0x7fffd4683cc8,0x7fffd4683cd8
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,10177021704755598661,6996813873685305407,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,10177021704755598661,6996813873685305407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,10177021704755598661,6996813873685305407,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,10177021704755598661,6996813873685305407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,10177021704755598661,6996813873685305407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,10177021704755598661,6996813873685305407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,10177021704755598661,6996813873685305407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,10177021704755598661,6996813873685305407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,10177021704755598661,6996813873685305407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,10177021704755598661,6996813873685305407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,10177021704755598661,6996813873685305407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,10177021704755598661,6996813873685305407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:2592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1860

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3972

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
PID:2568
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
  2⤵
  PID:4128
- - C:\Windows\SysWOW64\unregmp2.exe
    C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
    3⤵
    PID:456
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
      4⤵
      Modifies Installed Components in the registry
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Modifies registry class
      PID:684
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /Play C:\Users\Admin\Desktop\UninstallExpand.wmx
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2072
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  PID:2328
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:1520

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:576

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3796

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2320

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ef855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4aa37444d26e81e6f3837eb15bcaa892

SHA1
3d00127097989429f311f33daa8380ad7af4cb56

SHA256
ab703e5dfb5b92527f094fad6ec479839375907700be9a2fd1c3cb9105f9e655

SHA512
f21a34c234433a688602b2b56d6844f224641bea45b8585f77f4853e192107a65c5e104e10cd86c1d97ff41a22fd05d65224993803b22113ed0b517e686c5176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a43b81a1da5bb991601a9d258af22f10

SHA1
5d0f03ed280d785d51d687e51c1af7ee4dfb1090

SHA256
01b1d6c403fca930ceeddb03ece255a14e51c12f55cb54c3a47dce7ba88ac62a

SHA512
4ffd0eacb41d9a4434ae2790d80d14a0e6085247d6be5d5cc3ab380b8ac083e41dc7e4ece48c42b0c2e7b19c9c2657d08fe591260284313590579175635dc5ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e99aa068634813c8ceb90a3210e80d27

SHA1
4d62698bc2442c9b79b529825d3b6e01c50c2d11

SHA256
1b8f6836caf0d09a75c35ab2f7933c94e12d4070c8b5a96474a7e9eed1927b23

SHA512
5ab67929d847d0404868c3f5241dcba7927b03b4e040cd895d77c402986d0070b011e4371c045e16cd6e7dab0c7d498d0a09f75935a096338097810a1ab215d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2e78dcc2d74f3e86432e9f89b48051a1

SHA1
92789db1352acf82815efc0550aa83c76d6f53c7

SHA256
6d188a10909f934b1acee7f1506a13637aab96cb60631f39debea99297a13a52

SHA512
b193977c37c01c0d2870927c634b1c51bcab634ea8f3e5766cd0e29547e6165e3e94ec1a799ceb4366371d5099235b01f2800c3e6777e08f5a43c8f9243178b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9f1ae01636ada2acc7dde27049eff68

SHA1
1b290d7559acc161753a6ddb4fed3a39c1bb9269

SHA256
0e19f2c50815bbee2d558c7f421e2f830898e60293d04036a9906b8c5fb02364

SHA512
a2b0aed40fc05dfbbd849d07052a65497ea897b48253fa25c90736b757e63cb0c46e285d55fdd59044688eead82ad00014d61de3cc1bb1df25ea59cb8fcfbd15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
40833cdbd5d7994ce8fa41b927a81b3c

SHA1
7d0113a707e380a6c12a7581af0184b6e49ba481

SHA256
857a656a5e259b4671d5778cf4c93bf038e060b195cb7e9fb3d9c5bf25c8f2f7

SHA512
38d77bf562e1abeffd91ada2832a160d29509ed748751f43de43c5846c9fffab53884fe31b19ee7336c36557d726b9ff17dcdda0f311d8f04407e44748f2f4e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
77123f955f0848a1545684b08e9beed1

SHA1
7a66fecebb14f53a716c3616f5cce3ff60daf0a6

SHA256
393d8633d4c721df5be42b8911fe0bb010c24566e53f09232cfd7d0a9045e754

SHA512
a9e96f32b000649288078d2ff7636836cc91e5070c6ae19874c9e512bb9d6c31b658958ee1705f4813aa567a0d28c7dd2fa0f279309b3a65ba8940412880b64e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1d43e05b2ae30ddf737cda980c21222a

SHA1
68a556d9e35ea3e1e193078aad8a204fe0e0727a

SHA256
5b0248caae7d6f1b12f92c20391cf248104a5dfcaa5b974034b35a3b77485920

SHA512
e2603c7c067f74d4afdcfb4a9cfb9594d2065c58ab00160c2364aab7497f2f411451d5502e617d3434f84e34e277f24abe93716711d08dfd415aaf6d8e6584c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2bec564c42124040af77abfaa2d53863

SHA1
1d2e85e4130d1189327cb9e86b4517924bb934c3

SHA256
243d4f2f298287fb5cb4b598afa8e4991c83678e1f30564639f3b4b073f77023

SHA512
eb53470fcdd18f7b3a7670f7a647c455e6217dd8eddf8c11413c7d06b774021ca56afaac976b8204f3a8704b3b27000ef6d54a2bc7163abe1e1c308b42443b2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4bd8525976d8d510af9d91ec0e978682

SHA1
518c8917683b5ee3d2018e31e2cf8847546261bc

SHA256
810b79f817480dd65948be7d7c7b4660a00ecb4cdae7906ecf32e2f3202d3bae

SHA512
26f2377bc34ad1688c9faab5c60f17bac4df294a98e69a90062c4dc00c3eeacb8fe20dfda868ddfd0e193065632c710bcc6f73e0e89bf39c066e2436ccbd083f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
bbb416e94d91b0dfbb49e250efb4e183

SHA1
bbf9700fd646ed2de62e7efc230b578e7cb5d414

SHA256
82302657180df4c8f2f81df34d3150f263b1a51773fc168b0b639906163d0dd5

SHA512
13d07ae391a9429f508a052aa7c6fa39fdc1d18963e2697f7918229dbebcaf937c65fa4209099178a9ca66e8ccb48544f24a073ca24837e65983f1517b054d3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
b326b8edc41f575900c6783aab000c9c

SHA1
1639f3dbcca0cbf2ee1fa92f48036ee506c332d5

SHA256
4bec808b4f7957edbc5214b1f0fe31ac96ffff0688f1ba3316e2100bbc709c6a

SHA512
989c8de5bea32ea6e6c8a1dbc28b3f0a288ee98eae507b89c3f2ada95add8c7760e8a4678d09531b2bb7d025cb85039ec44a82fdbaf7baf1abe6f6cd691a6ccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
c1aae28f6dfde7dce20da53868979a08

SHA1
d8d7812b1338f547d7d345c805ea034e0fe814fa

SHA256
b00dd88fcd9fb26a3afda2e652ed830950d0315371065ede6a7eff9aef77c330

SHA512
d4fae8f55d86526b702a1390d231a2624bdcb032089d58126ba168cc33a61885a02dd677da21a5e19c23ba92075db4a66e6a60621af998dc3c1138ec67e45deb

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
f5a0e9215fbfe678941d93d1b13a59c9

SHA1
c6522f791f39abfc30f7b8553bb5758385d06297

SHA256
612b05b077d17ef3ea28ff729ec8bf842403141a0d9934e082c967e0c8a61705

SHA512
05d3074a68dae0d09fedea8e5af8d909bca2fa2d7e8fb8825e3061abe335a19b3bf8b54d90efbe8db969b0bc7eaf0552fa93066d4e80ede9b6702ee0357732a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
d9b47082cf78a84b8bf2486d073d493c

SHA1
c97b4fd0a142cce01f8b8e2e0ee95157614bc948

SHA256
ca53298c9a66c445c6bf128867fe2bb6b36de09ddf08056f7f8ba8fd95f52364

SHA512
f2de113a52df30934d51f0fa1158b3a8a13a1ea26e582296e78b3ca32a43fb6f1d1140c0af34fe01369894ed1c2e3179582f94895fdaee310cf3c64db0c9b4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
2KB

MD5
aa4f735d7abc8a2a70ccd26e03cc2953

SHA1
047d5ce3328ad8d43e8f5f7a83d2ec552b12404c

SHA256
6d847d832ac19a86715e9c20ed72180909925f7322ffe9175f11d9d4d07e2cdf

SHA512
3e3f2b6c71443fd715f0875297e0463d9aea1a0d7b3b8e5da2317167b0458873f0e5ef23719abd129de55bde2f3a8ce14a2b19d43b95c344779ecc3c22bb5e71

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
1KB

MD5
4eb211c72e85460e8c2ec02c1838dba3

SHA1
ba9eb499304f756d84b86b4798ed194cbe4cf241

SHA256
ca384d94aa019aa1af1ceb6d6d00a7b17cb682b787ff58a6e2d0f7f5788d4c06

SHA512
8d27d232b14a11bba986966cc495206e09c2bbabee60f4685b98b47b02c72d980e460b03040071c135e072f2d46206db42bfd6d75748bdfa3810a09f079e566d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
d7fb5a4a192fe399c032b2b1843f1a4b

SHA1
1cadd6febabae5121e7167ced1b980b762d5bf97

SHA256
2a5d2e4ca4f1bbe021c2b123638a397d8058cbebdf2d776a20af27149e4a8b68

SHA512
5a28fc00b98de7a35ff74045612cc513052c58c6eca7426a0e87aa3e125586c79ef3915a64a9db615f72d88ad1ebe62e65a5272929ca4dbfcdbe1ab26c1fc38b

Download Submit
C:\Windows\System32\7l3gmnalufxr2.exe

Filesize
1.6MB

MD5
f8d464423985f8d935f519a4dd5bd36d

SHA1
6084a56d3581446a401803fe3426811966a089ff

SHA256
619b3babc5b3b6683590e10da7dd7ff9e596eb66cd7d96a06537e3c6354e4f27

SHA512
e6d7c5df9a6d5e8075288c1b189ca42751330181124ef9636ac19d9a27bafa0185306f6f2968bff134ff64f3ec742b0c08d982986c92bc4720c951d6787e7e46

Download Submit
C:\Windows\System32\ActionCenter.dll_BUP

Filesize
372KB

MD5
07537ad506a894ea3e9de6fd9647b19d

SHA1
8b819a43feab62cb5d8b1502e4989d6689d203c5

SHA256
602cc452d46ea189891c41fea1e6bf54c3fce63f09bcf2884625bb6717e5fcbb

SHA512
43ffc8b88d574805bd9d1de43f7b256e864cba6b8d24c229760a2d856dae8f6c3c9f69ea2a3eacf255bb9b73646d55b68c78cf323aea315c56ae6d44fe0674d2

Download Submit
C:\Windows\System32\ActionCenterCPL.dll_BUP

Filesize
156KB

MD5
c3b7b70c2a6b617ca33b1637f1bca31d

SHA1
eb30449f467942db7d69873ec4943b896c93e074

SHA256
074038d79e86b9eeeb33e1dba329d72b95d2028c9b0648b51955937ff03c5779

SHA512
6a0305eb33a29af270ad30f4b337a3e38a1044df58b913489b48ae71bd015bf0be2aa7cf262752f54b80c835e30c4dc07ed6322b4d37551daea982c0d08e9b4a

Download Submit
memory/3972-93-0x000002893A5C0000-0x000002893A5C1000-memory.dmp

Filesize
4KB

Download
memory/3972-105-0x000002893A5C0000-0x000002893A5C1000-memory.dmp

Filesize
4KB

Download
memory/3972-104-0x000002893A5C0000-0x000002893A5C1000-memory.dmp

Filesize
4KB

Download
memory/3972-103-0x000002893A5C0000-0x000002893A5C1000-memory.dmp

Filesize
4KB

Download
memory/3972-102-0x000002893A5C0000-0x000002893A5C1000-memory.dmp

Filesize
4KB

Download
memory/3972-101-0x000002893A5C0000-0x000002893A5C1000-memory.dmp

Filesize
4KB

Download
memory/3972-100-0x000002893A5C0000-0x000002893A5C1000-memory.dmp

Filesize
4KB

Download
memory/3972-99-0x000002893A5C0000-0x000002893A5C1000-memory.dmp

Filesize
4KB

Download
memory/3972-95-0x000002893A5C0000-0x000002893A5C1000-memory.dmp

Filesize
4KB

Download
memory/3972-94-0x000002893A5C0000-0x000002893A5C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads