c83921c8dda800ef24ebe873ec175617110dc9deb2629d1107f219ca30caece3

Analysis

max time kernel
14s
max time network
21s
platform
windows10-2004_x64
resource
win10v2004-20240226-de
resource tags

arch:x64arch:x86image:win10v2004-20240226-delocale:de-deos:windows10-2004-x64systemwindows
submitted
15/03/2024, 20:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

applecleaner.exe
Size

3.3MB
MD5

ba268b881bccd2784fe98289eec8ad72
SHA1

0c4e7f1473fb7ab22427480c3d784b6e0e404956
SHA256

c83921c8dda800ef24ebe873ec175617110dc9deb2629d1107f219ca30caece3
SHA512

30c836bb91ef96f5952571bba27d08c32011e619890fae392f882e5c7db7558ed26e6aa1fbdc2ce7d22c0a6aebc580e17ae807de70d99945cb2b438bd8cbbb3b
SSDEEP

49152:98jzvhuGMsOTenal2tV594MzhJD3TMgwQiPRxksa2EQUFO0JIbn6/ubWYY725hXQ:9QFXlbnal2XDhZRwRVsE0JDoWYJPXLk

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	applecleaner.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5808	netsh.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	applecleaner.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion = 52004f0061004b005300200020002d002000350000000000	applecleaner.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/5008-0-0x00007FF618000000-0x00007FF618923000-memory.dmp	themida
behavioral1/memory/5008-2-0x00007FF618000000-0x00007FF618923000-memory.dmp	themida
behavioral1/memory/5008-3-0x00007FF618000000-0x00007FF618923000-memory.dmp	themida
behavioral1/memory/5008-4-0x00007FF618000000-0x00007FF618923000-memory.dmp	themida
behavioral1/memory/5008-6-0x00007FF618000000-0x00007FF618923000-memory.dmp	themida
behavioral1/memory/5008-5-0x00007FF618000000-0x00007FF618923000-memory.dmp	themida
behavioral1/memory/5008-131-0x00007FF618000000-0x00007FF618923000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	applecleaner.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	applecleaner.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer = "0ab7"	applecleaner.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5008	applecleaner.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 30 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	applecleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemBiosVersion	applecleaner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	applecleaner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	applecleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion = "KD-GBA-D.2"	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	applecleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier = "41e1ff02-b105e9a0-5"	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	applecleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	applecleaner.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	applecleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion = "NO0-K.KM.J-4-E4N54D7E-52NJC1QQ.ED9C.1OD"	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	applecleaner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	applecleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion	applecleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	applecleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName = "LD29KOB7 2G (ENQ + 8A19, MG12)"	applecleaner.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	applecleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier = "518cfa77-f27e7504-b"	applecleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	applecleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer = "9MLL"	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5232	ipconfig.exe
3632	ipconfig.exe
3892	ipconfig.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
5028	taskkill.exe
4364	taskkill.exe
4532	taskkill.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
3040	msedge.exe
3040	msedge.exe
5008	applecleaner.exe
5008	applecleaner.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	taskkill.exe
Token: SeDebugPrivilege	4364	taskkill.exe
Token: SeDebugPrivilege	4532	taskkill.exe
Token: SeIncreaseQuotaPrivilege	548	WMIC.exe
Token: SeSecurityPrivilege	548	WMIC.exe
Token: SeTakeOwnershipPrivilege	548	WMIC.exe
Token: SeLoadDriverPrivilege	548	WMIC.exe
Token: SeSystemProfilePrivilege	548	WMIC.exe
Token: SeSystemtimePrivilege	548	WMIC.exe
Token: SeProfSingleProcessPrivilege	548	WMIC.exe
Token: SeIncBasePriorityPrivilege	548	WMIC.exe
Token: SeCreatePagefilePrivilege	548	WMIC.exe
Token: SeBackupPrivilege	548	WMIC.exe
Token: SeRestorePrivilege	548	WMIC.exe
Token: SeShutdownPrivilege	548	WMIC.exe
Token: SeDebugPrivilege	548	WMIC.exe
Token: SeSystemEnvironmentPrivilege	548	WMIC.exe
Token: SeRemoteShutdownPrivilege	548	WMIC.exe
Token: SeUndockPrivilege	548	WMIC.exe
Token: SeManageVolumePrivilege	548	WMIC.exe
Token: 33	548	WMIC.exe
Token: 34	548	WMIC.exe
Token: 35	548	WMIC.exe
Token: 36	548	WMIC.exe
Token: SeIncreaseQuotaPrivilege	548	WMIC.exe
Token: SeSecurityPrivilege	548	WMIC.exe
Token: SeTakeOwnershipPrivilege	548	WMIC.exe
Token: SeLoadDriverPrivilege	548	WMIC.exe
Token: SeSystemProfilePrivilege	548	WMIC.exe
Token: SeSystemtimePrivilege	548	WMIC.exe
Token: SeProfSingleProcessPrivilege	548	WMIC.exe
Token: SeIncBasePriorityPrivilege	548	WMIC.exe
Token: SeCreatePagefilePrivilege	548	WMIC.exe
Token: SeBackupPrivilege	548	WMIC.exe
Token: SeRestorePrivilege	548	WMIC.exe
Token: SeShutdownPrivilege	548	WMIC.exe
Token: SeDebugPrivilege	548	WMIC.exe
Token: SeSystemEnvironmentPrivilege	548	WMIC.exe
Token: SeRemoteShutdownPrivilege	548	WMIC.exe
Token: SeUndockPrivilege	548	WMIC.exe
Token: SeManageVolumePrivilege	548	WMIC.exe
Token: 33	548	WMIC.exe
Token: 34	548	WMIC.exe
Token: 35	548	WMIC.exe
Token: 36	548	WMIC.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4780	5008	applecleaner.exe	90
PID 5008 wrote to memory of 4780	5008	applecleaner.exe	90
PID 4780 wrote to memory of 5028	4780	cmd.exe	91
PID 4780 wrote to memory of 5028	4780	cmd.exe	91
PID 5008 wrote to memory of 220	5008	applecleaner.exe	94
PID 5008 wrote to memory of 220	5008	applecleaner.exe	94
PID 220 wrote to memory of 4364	220	cmd.exe	95
PID 220 wrote to memory of 4364	220	cmd.exe	95
PID 5008 wrote to memory of 3548	5008	applecleaner.exe	96
PID 5008 wrote to memory of 3548	5008	applecleaner.exe	96
PID 3548 wrote to memory of 4532	3548	cmd.exe	97
PID 3548 wrote to memory of 4532	3548	cmd.exe	97
PID 5008 wrote to memory of 1344	5008	applecleaner.exe	102
PID 5008 wrote to memory of 1344	5008	applecleaner.exe	102
PID 1344 wrote to memory of 3040	1344	cmd.exe	103
PID 1344 wrote to memory of 3040	1344	cmd.exe	103
PID 3040 wrote to memory of 2252	3040	msedge.exe	105
PID 3040 wrote to memory of 2252	3040	msedge.exe	105
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 3656	3040	msedge.exe	106
PID 3040 wrote to memory of 1104	3040	msedge.exe	107
PID 3040 wrote to memory of 1104	3040	msedge.exe	107
PID 3040 wrote to memory of 4944	3040	msedge.exe	108
PID 3040 wrote to memory of 4944	3040	msedge.exe	108
PID 3040 wrote to memory of 4944	3040	msedge.exe	108
PID 3040 wrote to memory of 4944	3040	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\applecleaner.exe
"C:\Users\Admin\AppData\Local\Temp\applecleaner.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Checks system information in the registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im EpicGamesLauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Battle.net.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Battle.net.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://applecheats.cc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://applecheats.cc/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa331c46f8,0x7ffa331c4708,0x7ffa331c4718
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,2189982398685733533,5888665883124020569,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
      4⤵
      PID:3656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,2189982398685733533,5888665883124020569,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,2189982398685733533,5888665883124020569,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2189982398685733533,5888665883124020569,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      PID:548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2189982398685733533,5888665883124020569,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2189982398685733533,5888665883124020569,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2189982398685733533,5888665883124020569,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2189982398685733533,5888665883124020569,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:5124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH WINSOCK RESET >nul 2>&1
  2⤵
  PID:5668
- - C:\Windows\system32\netsh.exe
    NETSH WINSOCK RESET
    3⤵
    PID:5688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INT IP RESET >nul 2>&1
  2⤵
  PID:5744
- - C:\Windows\system32\netsh.exe
    NETSH INT IP RESET
    3⤵
    PID:5760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall reset >nul 2>&1
  2⤵
  PID:5792
- - C:\Windows\system32\netsh.exe
    netsh advfirewall reset
    3⤵
    - Modifies Windows Firewall
    PID:5808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV4 RESET >nul 2>&1
  2⤵
  PID:5844
- - C:\Windows\system32\netsh.exe
    NETSH INTERFACE IPV4 RESET
    3⤵
    PID:5860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV6 RESET >nul 2>&1
  2⤵
  PID:5892
- - C:\Windows\system32\netsh.exe
    NETSH INTERFACE IPV6 RESET
    3⤵
    PID:5908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INTERFACE TCP RESET >nul 2>&1
  2⤵
  PID:6052
- - C:\Windows\system32\netsh.exe
    NETSH INTERFACE TCP RESET
    3⤵
    PID:6068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INT RESET ALL >nul 2>&1
  2⤵
  PID:6108
- - C:\Windows\system32\netsh.exe
    NETSH INT RESET ALL
    3⤵
    PID:6124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1
  2⤵
  PID:2328
- - C:\Windows\system32\ipconfig.exe
    IPCONFIG /RELEASE
    3⤵
    - Gathers network information
    PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1
  2⤵
  PID:4144
- - C:\Windows\system32\ipconfig.exe
    IPCONFIG /RELEASE
    3⤵
    - Gathers network information
    PID:5232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c IPCONFIG /FLUSHDNS >nul 2>&1
  2⤵
  PID:3900
- - C:\Windows\system32\ipconfig.exe
    IPCONFIG /FLUSHDNS
    3⤵
    - Gathers network information
    PID:3632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NBTSTAT -R >nul 2>&1
  2⤵
  PID:4280
- - C:\Windows\system32\nbtstat.exe
    NBTSTAT -R
    3⤵
    PID:60
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NBTSTAT -RR >nul 2>&1
  2⤵
  PID:3548
- - C:\Windows\system32\nbtstat.exe
    NBTSTAT -RR
    3⤵
    PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c arp -a >nul 2>&1
  2⤵
  PID:5012
- - C:\Windows\system32\ARP.EXE
    arp -a
    3⤵
    PID:4816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c arp -d >nul 2>&1
  2⤵
  PID:4556
- - C:\Windows\system32\ARP.EXE
    arp -d
    3⤵
    PID:5248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE >nul 2>&1
  2⤵
  PID:5260
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
05aa4dd8c2622841b3e77fd71170d15e

SHA1
042572841b5dbe41eff90afdf5802df281e36d6e

SHA256
4c1a39f3dc2cb8cf7b756eb9f1a556fa748fc51effa11e4b4a534b747d181ac6

SHA512
3019b374a747b8e80ef404c7461b8a8a9d7e0e68f0e585d66f8643713618257835ecea70e887c1caef3194ba6549132a43ac47c181eb28d9204375d3e2a5dd09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
554B

MD5
0f4916d1a72620956e2483ae1bd124b5

SHA1
4e094b5f3504fc1dbe7850cb518434b6b25dbddb

SHA256
9df748da6c2d060a6d697ceeee009791e73e8bd0e074f6eac22a134cb115b89e

SHA512
86c7c58f89f34875e909f7f2fe8afe442710a5451bad1f367510f64c6682d4a1138594a1288f3b2dbcb9ef2bed8bd77ba60c87f5bcb94828f9ff15233439fd7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0574e817fd2a460545c5116c0081f3b8

SHA1
00d19304d3016febb650aaae228c4a7dce522726

SHA256
d805edcc7efd69c2edc3d214f3c8cf0173149f270487663dc96a128816314bef

SHA512
af2aaccd9a6c6abd59434950b55f1d4c90664e3ed70d543a9e5b815fb13e6240d0847323bcec20d75f4eb77ce9ddf304b87d5091df0ffe20ceb732d0ff624668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6107d6f4872ade75da1813f8523ead36

SHA1
6202c7721e2edc05236b25cc13192b7e9feb78a6

SHA256
ab02c1b9eefcdc4b8b44ac81ea787435d4860bc8949c84dfed846db2933c9725

SHA512
1f2c9750ee8d3b06b56c338a249647f0fba73f6c1c36919213379bab0f16134c47a921f5ed076a04ed89dcb0bdf9d0e9ebbed647637b73e927b877ec46bfa53c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c473e2f033de305e0d462dc066911a72

SHA1
12a53afeb748dc0f5c6d6bb2d1988bd9e4f2215f

SHA256
915b237f6e26b18db2935ff3b0a1e005f9f97596885074c1fba3455baa8f242d

SHA512
8894d231f293f1259c8ffa4bf6e8d2fd07c6e2af25d84d145c1e839e4f969b3a34c80c8c945e9f51cd03a9a2731eb6aba27cf3e38f06ca9097298949b62f3e67

Download Submit
memory/5008-0-0x00007FF618000000-0x00007FF618923000-memory.dmp

Filesize
9.1MB

Download
memory/5008-5-0x00007FF618000000-0x00007FF618923000-memory.dmp

Filesize
9.1MB

Download
memory/5008-6-0x00007FF618000000-0x00007FF618923000-memory.dmp

Filesize
9.1MB

Download
memory/5008-4-0x00007FF618000000-0x00007FF618923000-memory.dmp

Filesize
9.1MB

Download
memory/5008-3-0x00007FF618000000-0x00007FF618923000-memory.dmp

Filesize
9.1MB

Download
memory/5008-2-0x00007FF618000000-0x00007FF618923000-memory.dmp

Filesize
9.1MB

Download
memory/5008-1-0x00007FFA522B0000-0x00007FFA524A5000-memory.dmp

Filesize
2.0MB

Download
memory/5008-131-0x00007FF618000000-0x00007FF618923000-memory.dmp

Filesize
9.1MB

Download