4026e330b06e54fb334314ecac5ceca07830967a84f11bd8803a20164653109b

Analysis

max time kernel
1772s
max time network
1678s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
07-03-2024 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

creal.pyc
Size

32KB
MD5

eb61d23367de0ebe3776c297b3af611b
SHA1

68308d6df71bc573e56d3023fdfc7729e05f0dd4
SHA256

2fa9d7b0f42e63994c1f96c6cfae62f9c3491a53605a1d2212309cd8cdd132a3
SHA512

6fce08320a5f37ba6da9a082634a3b92040c58f8846fed09c000604474f94f09aebf88c2c1cadbea63fd8762d6aa83725a700707159b0e43748447bb46f6a5f3
SSDEEP

768:L8Dnrt2VsfNEiyAuAfKFMrRtfqtvEwS7bnjerAroaHDsIAvN8YC06X:IjrNe3aKFcfDwS7fOPviYD6X

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SRU\SRU.chk	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRU.log	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUDB.dat	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUDB.jfm	svchost.exe
File created	C:\Windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{d2855e7d-1ed5-4410-a13a-451d5fff31bc}\snapshot.etl	svchost.exe
File opened for modification	C:\Windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{d2855e7d-1ed5-4410-a13a-451d5fff31bc}\snapshot.etl	svchost.exe
File opened for modification	C:\Windows\system32\WDI\BootPerformanceDiagnostics_SystemData.bin	svchost.exe
File created	C:\Windows\system32\wdi\LogFiles\StartupInfo\S-1-5-21-4181651180-3163410697-3990547336-1000_StartupInfo3.xml	svchost.exe
File opened for modification	C:\Windows\system32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4181651180-3163410697-3990547336-1000_UserData.bin	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
3452	msedge.exe
3452	msedge.exe
3140	msedge.exe
3140	msedge.exe
1400	identity_helper.exe
1400	identity_helper.exe
5984	sdiagnhost.exe
5984	sdiagnhost.exe
4336	svchost.exe
4336	svchost.exe
4336	svchost.exe
4336	svchost.exe
4336	svchost.exe
4336	svchost.exe
4336	svchost.exe
4336	svchost.exe
4336	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2112	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5984	sdiagnhost.exe
Token: SeShutdownPrivilege	4336	svchost.exe
Token: SeCreatePagefilePrivilege	4336	svchost.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
4528	msdt.exe
3452	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2112	OpenWith.exe
4944	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 3896	3452	msedge.exe	88
PID 3452 wrote to memory of 3896	3452	msedge.exe	88
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 2720	3452	msedge.exe	89
PID 3452 wrote to memory of 4764	3452	msedge.exe	90
PID 3452 wrote to memory of 4764	3452	msedge.exe	90
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91
PID 3452 wrote to memory of 1252	3452	msedge.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\creal.pyc
1⤵
- Modifies registry class
PID:4212

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2112

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcfbf53cb8,0x7ffcfbf53cc8,0x7ffcfbf53cd8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,15087374946870555614,1160060437629748162,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,15087374946870555614,1160060437629748162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,15087374946870555614,1160060437629748162,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,15087374946870555614,1160060437629748162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,15087374946870555614,1160060437629748162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,15087374946870555614,1160060437629748162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,15087374946870555614,1160060437629748162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,15087374946870555614,1160060437629748162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,15087374946870555614,1160060437629748162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,15087374946870555614,1160060437629748162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,15087374946870555614,1160060437629748162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,15087374946870555614,1160060437629748162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,15087374946870555614,1160060437629748162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,15087374946870555614,1160060437629748162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,15087374946870555614,1160060437629748162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3484
- C:\Windows\system32\msdt.exe
  -modal "328226" -skip TRUE -path "C:\Windows\diagnostics\system\networking" -af "C:\Users\Admin\AppData\Local\Temp\NDF70C6.tmp" -ep "NetworkDiagnosticsWeb"
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,15087374946870555614,1160060437629748162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,15087374946870555614,1160060437629748162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2644 /prefetch:1
  2⤵
  PID:5516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5984
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter
  2⤵
  PID:768
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter
  2⤵
  PID:5324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
1⤵
PID:5180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s WdiServiceHost
1⤵
- Modifies data under HKEY_USERS
PID:5428
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\winethc.dll",ForceProxyDetectionOnNextRun
  2⤵
  PID:4936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5372

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5772

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:5808

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:5864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024030717.000\NetworkDiagnostics.debugreport.xml

Filesize
73KB

MD5
0d1e4aea1c6b47446df2a835b1712173

SHA1
933b15334e781dd75313f114a1b4eef235d7c174

SHA256
74e4e57e9fc581039b44419b046e3ac5416bde42a1e1f29f02d9de9cc449096d

SHA512
d673b94b7e1fcf847a0dae3fdb2363ec8d5b0c5340c4e2332b440c82d08c62862c177e460f6dc65dfaf8d841d7bd70f8f02fb13163d97e3fa2cc402767690715

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024030717.000\results.xsl

Filesize
47KB

MD5
90df783c6d95859f3a420cb6af1bafe1

SHA1
3fe1e63ca5efc0822fc3a4ae862557238aa22f78

SHA256
06db605b5969c93747313e6409ea84bdd8b7e1731b7e6e3656329d77bcf51093

SHA512
e5dcbb7d8f42eabf42966fccee11c3d3e3f965ecc7a4d9e4ecd0382a31c4e8afea931564b1c6931f6d7e6b3650dc01a4a1971e317dab6c1f03932c6b6b7d399f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\25868b32-8bb8-4634-a71c-acab50afcd86.tmp

Filesize
8KB

MD5
beb4370ce40f2a29c19446e05e25191e

SHA1
aa0b1a0c1b95f6158c6fb7e1d8022c6b120f6de3

SHA256
d0651c90affc0272db5dfb50652bd3616f49d0b9ab8accc26099c13734ead5d9

SHA512
91b983d225d3cb500e25f415f3a935ca62bcc432414867d0700b6647d36705206e635fad6628a0f063dc8c0781224a6b99fba7b9cc4b5e50300f065b2afd5f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0e10a8550dceecf34b33a98b85d5fa0b

SHA1
357ed761cbff74e7f3f75cd15074b4f7f3bcdce0

SHA256
5694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61

SHA512
fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3b1e59e67b947d63336fe9c8a1a5cebc

SHA1
5dc7146555c05d8eb1c9680b1b5c98537dd19b91

SHA256
7fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263

SHA512
2d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6a4304ed4f2870e28aaacb69b425aa19

SHA1
062abe3b042f1a20264d130dfb9c16cb20975a9b

SHA256
199a6141232a0cacf17b5ebe95b3457047c0a5ef637476e9b9582049352b0010

SHA512
ba9f12f9eb51ba3abe95e4f2db296f0c2c8fea6b18f3fc42501b96f014f52c7b650a06afec360e674ebcfb0bad8ca3df8234c57454917d11c23e9ae20bf57732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aae091ad37a1e2e705ea37868cd3a1e1

SHA1
13b79c11021bf2d93bc0079b5315bb878127b275

SHA256
1e847a48cdd7aae71b5a430513edd3c65c4ace5a8b0df6a9367d6a534c88540a

SHA512
4dc5f7dda6c3e74f57f4154d816a093b40db038c350d307cc9b7ca3858385b8a3682fc7c70a88f342487f1915fb2a264ae8a03366b513ad283c2afd48540da63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
434a5ed99195f661578e89ae96c9d57b

SHA1
860a6d47f49b9e8a8709a4438d334e1251e50910

SHA256
500271712f2ee2b60a65342db78a507ac32cb570b0d830cf368d9d3e74a7d2aa

SHA512
f7ce326e0644be68c323c7364327e8e2f4f6db3c08e7f2885f6234a89ce3593daeaa3164e0d2c896c34a486bba1f8c9099717be7436e9293a5dc8925a98e066f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d12271641563399ef02f7b3a15608ddf

SHA1
286b8a9a47bb81a1452ff9b7495556fae08bbed2

SHA256
bf48f9f3f81a18a4d0401417bf921d12103a1528c0fdee08754fd046b4437f5e

SHA512
5b2bb02aba5b0068a5917d32f45435a9b94098914d941c7bad28a1577c3d8c475cf70b08d18278ab52a0df8faf20d08bbe5b9ec9b944b1ddb12bc56ec89ebabe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
e0e95ed9a7d47d05d100400f898a9f30

SHA1
019aff1c0c068246945db57f7ae1ab4ce2d38bfd

SHA256
1a5472bf838b8e4a0cc55ebc7be5255c370343882ff83c9fc9760f129b2d0bd8

SHA512
dd01390d03708ab1dcad52bf00eb729e8575334b128c574a2d6583f9569a36c1d6cc4ed51fe46e03bdabad111c0f8450e9799547d03cbfe048eaef9e25e2fd03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
a4167d7c3b943d4e63c59a04641c042d

SHA1
b5161b8629f6dac191d91f22590980fb6b4c757c

SHA256
bb4936bda66a35b1809d412a0dccf442fbca3741d9d207738831ce75429ead61

SHA512
8eeb000657cc2119beec99ba2c54163cd862fdfbda5cb7af01b8f9fb363a77d2dc751a2c08f1f91722361165cdc256c0ad826c65acd3ccdacc0bf7d415570953

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-3-7.1716.5808.1.odl

Filesize
1KB

MD5
bb818f1c53d08605858371a16afc312d

SHA1
4c369350954fcca71e2ef65984f8746c7b7167c0

SHA256
a492e10baf1d25cda469f6b614fab5f2c4ed416de576d6500cec4f1cb30a6975

SHA512
f7ae7bbcc0cfb010e5d29caebc15d47578d13cf8e1e0daecd3fea21652eb03d99e1460608d2d79d9eb14b7ab0b366a94d0271e9f302cc678d0db3dd6cba210d1

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
82678367fa4297a26727ccc84e0b2f60

SHA1
0c65ab90390566f7d2f5b4751b9027f6bac1d22a

SHA256
fbf7356b28e05edc871dda40b318b147e6d07ece028da3d67c3cfbd30bfa0f29

SHA512
e5474444eecac25a06fe26a22dce9aa9311740dca264de1c824a36a7bc55216f301e934667fe0b9c3c7b062694f8a37e45ecce6b3889cb33bb47ecb9bd198db5

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
28d32a16ce87d488acc7632092f7d566

SHA1
325dd247e49113dd987531ffe7ca26c22ce08c31

SHA256
ba6d4f09117c098bd27508a14d44822f13399ebe16d5d2539ad2844157fa4907

SHA512
8159021f9d0e28d370faddf7fa41aa9d4bdf7a1aee71779706e43c30486526a0636568d8f90c580da543f8393f546090f71f87382f99e3e0a2b227b04670af57

Download Submit
C:\Users\Admin\AppData\Local\Temp\NDF70C6.tmp

Filesize
3KB

MD5
a9e92c50084c7d056e4a6b76677aa295

SHA1
5307c3d356a57f1f074abdc0743ba9d33c5062c3

SHA256
fcec1b1431322148abc8157c8cfcaaa7da3d8df971e91a3ed26790813b877638

SHA512
70e78f42d4bc51c4b30d61c88ff5593da42c58d3cceb5c1082619a9ca0af460e600e496c41a0a6163e06eef853bcd51df19278c6e3409b7edbec50574ecb9e9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_22kfylux.fh1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\TEMP\SDIAG_69e44846-93f5-4a1f-b490-2a55ae6aae95\NetworkDiagnosticsTroubleshoot.ps1

Filesize
25KB

MD5
d0cfc204ca3968b891f7ce0dccfb2eda

SHA1
56dad1716554d8dc573d0ea391f808e7857b2206

SHA256
e3940266b4368c04333db89804246cb89bf2073626f22b8de72bea27c522282a

SHA512
4d2225b599ad8af8ba8516f12cfddca5ec0ce69c5c80b133a6a323e9aaf5e0312efbcfa54d2e4462a5095f9a7c42b9d5b39f3204e0be72c3b1992cf33b22087c

Download Submit
C:\Windows\TEMP\SDIAG_69e44846-93f5-4a1f-b490-2a55ae6aae95\StartDPSService.ps1

Filesize
567B

MD5
a660422059d953c6d681b53a6977100e

SHA1
0c95dd05514d062354c0eecc9ae8d437123305bb

SHA256
d19677234127c38a52aec23686775a8eb3f4e3a406f4a11804d97602d6c31813

SHA512
26f8cf9ac95ff649ecc2ed349bc6c7c3a04b188594d5c3289af8f2768ab59672bc95ffefcc83ed3ffa44edd0afeb16a4c2490e633a89fce7965843674d94b523

Download Submit
C:\Windows\TEMP\SDIAG_69e44846-93f5-4a1f-b490-2a55ae6aae95\UtilityFunctions.ps1

Filesize
53KB

MD5
c912faa190464ce7dec867464c35a8dc

SHA1
d1c6482dad37720db6bdc594c4757914d1b1dd70

SHA256
3891846307aa9e83bca66b13198455af72af45bf721a2fbd41840d47e2a91201

SHA512
5c34352d36459fd8fcda5b459a2e48601a033af31d802a90ed82c443a5a346b9480880d30c64db7ad0e4a8c35b98c98f69eceedad72f2a70d9c6cca74dce826a

Download Submit
C:\Windows\TEMP\SDIAG_69e44846-93f5-4a1f-b490-2a55ae6aae95\UtilitySetConstants.ps1

Filesize
2KB

MD5
0c75ae5e75c3e181d13768909c8240ba

SHA1
288403fc4bedaacebccf4f74d3073f082ef70eb9

SHA256
de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f

SHA512
8fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b

Download Submit
C:\Windows\TEMP\SDIAG_69e44846-93f5-4a1f-b490-2a55ae6aae95\en-US\LocalizationData.psd1

Filesize
5KB

MD5
91f545459be2ff513b8d98c7831b8e54

SHA1
499e4aa76fc21540796c75ba5a6a47980ff1bc21

SHA256
1ccd68e58ead16d22a6385bb6bce0e2377ed573387bdafac3f72b62264d238ff

SHA512
469571a337120885ee57e0c73a3954d0280fa813e11709ee792285c046f6ddaf9be5583e475e627ea5f34e8e6fb723a4681289312f0e51dc8e9894492407b911

Download Submit
C:\Windows\Temp\SDIAG_69e44846-93f5-4a1f-b490-2a55ae6aae95\DiagPackage.dll

Filesize
488KB

MD5
ec287e627bf07521b8b443e5d7836c92

SHA1
02595dde2bd98326d8608ee3ddabc481ddc39c3d

SHA256
35fa9f66ed386ee70cb28ec6e03a3b4848e3ae11c8375ba3b17b26d35bd5f694

SHA512
8465ae3ca6a4355888eecedda59d83806faf2682431f571185c31fb8a745f2ef4b26479f07aaf2693cd83f2d0526a1897a11c90a1f484a72f1e5965b72de9903

Download Submit
C:\Windows\Temp\SDIAG_69e44846-93f5-4a1f-b490-2a55ae6aae95\en-US\DiagPackage.dll.mui

Filesize
17KB

MD5
44b3399345bc836153df1024fa0a81e1

SHA1
ce979bfdc914c284a9a15c4d0f9f18db4d984cdd

SHA256
502abf2efedb7f76147a95dc0755723a070cdc3b2381f1860313fd5f01c4fb4d

SHA512
a49ba1a579eedca2356f8a4df94b1c273e483ceace93c617cddee77f66e90682836c77cea58047320b2c2f1d0e23ee7efa3d8af71e8ee864faef7e68f233bec4

Download Submit
memory/4336-479-0x0000012B7A860000-0x0000012B7A870000-memory.dmp

Filesize
64KB

Download
memory/4336-663-0x0000012B7AD30000-0x0000012B7AD31000-memory.dmp

Filesize
4KB

Download
memory/4336-669-0x0000012B7AC70000-0x0000012B7AC71000-memory.dmp

Filesize
4KB

Download
memory/4336-666-0x0000012B7AD20000-0x0000012B7AD21000-memory.dmp

Filesize
4KB

Download
memory/4336-483-0x0000012B7AD20000-0x0000012B7AD21000-memory.dmp

Filesize
4KB

Download
memory/4336-475-0x0000012B7A820000-0x0000012B7A830000-memory.dmp

Filesize
64KB

Download
memory/4336-664-0x0000012B7AD20000-0x0000012B7AD21000-memory.dmp

Filesize
4KB

Download
memory/4336-661-0x0000012B7AE30000-0x0000012B7AE31000-memory.dmp

Filesize
4KB

Download
memory/4336-660-0x0000012B7AE40000-0x0000012B7AE41000-memory.dmp

Filesize
4KB

Download
memory/5984-446-0x000001BE9D220000-0x000001BE9D242000-memory.dmp

Filesize
136KB

Download
memory/5984-447-0x00007FFCF9110000-0x00007FFCF9BD2000-memory.dmp

Filesize
10.8MB

Download
memory/5984-448-0x000001BE9D2B0000-0x000001BE9D2C0000-memory.dmp

Filesize
64KB

Download
memory/5984-455-0x000001BE9D2B0000-0x000001BE9D2C0000-memory.dmp

Filesize
64KB

Download
memory/5984-486-0x000001BE9D2B0000-0x000001BE9D2C0000-memory.dmp

Filesize
64KB

Download
memory/5984-553-0x00007FFCF9110000-0x00007FFCF9BD2000-memory.dmp

Filesize
10.8MB

Download
memory/5984-485-0x00007FFCF9110000-0x00007FFCF9BD2000-memory.dmp

Filesize
10.8MB

Download
memory/5984-487-0x000001BE9D2B0000-0x000001BE9D2C0000-memory.dmp

Filesize
64KB

Download