hxxp://Youareanidiot[.]cc

Resubmissions

31/03/2024, 14:38

240331-rzx63sdf2v10

31/03/2024, 14:35

31/03/2024, 14:31

31/03/2024, 14:27

31/03/2024, 14:14

Analysis

max time kernel
138s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2024, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
http://Youareanidiot.cc
Sample240331-rychzsde7x

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
4156	7ev3n.exe
3168	system.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
113	raw.githubusercontent.com
114	raw.githubusercontent.com

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2088	SCHTASKS.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "125"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-399997616-3400990511-967324271-1000\{0F94AC7E-1138-445D-B6D4-CBD87EFA0BD5}	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 306821.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\system.exe\:SmartScreen:$DATA	7ev3n.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
752	msedge.exe
752	msedge.exe
432	identity_helper.exe
432	identity_helper.exe
2984	msedge.exe
2984	msedge.exe
3288	msedge.exe
3288	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2892	shutdown.exe
Token: SeRemoteShutdownPrivilege	2892	shutdown.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
704	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 2528	752	msedge.exe	85
PID 752 wrote to memory of 2528	752	msedge.exe	85
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 4692	752	msedge.exe	86
PID 752 wrote to memory of 2400	752	msedge.exe	87
PID 752 wrote to memory of 2400	752	msedge.exe	87
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88
PID 752 wrote to memory of 1528	752	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://Youareanidiot.cc
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd385346f8,0x7ffd38534708,0x7ffd38534718
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 /prefetch:2
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3288
- C:\Users\Admin\Downloads\7ev3n.exe
  "C:\Users\Admin\Downloads\7ev3n.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  PID:4156
- - C:\Users\Admin\AppData\Local\system.exe
    "C:\Users\Admin\AppData\Local\system.exe"
    3⤵
    - Executes dropped EXE
    PID:3168
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\del.bat
      4⤵
      PID:3500
  - - C:\Windows\SysWOW64\SCHTASKS.exe
      C:\Windows\System32\SCHTASKS.exe /create /SC ONLOGON /TN uac /TR "C:\Users\Admin\AppData\Local\bcd.bat" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:2088
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
      4⤵
      PID:4420
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
        5⤵
        Modifies WinLogon for persistence
        
        PID:2248
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
      4⤵
      PID:3592
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
        5⤵
        Adds Run key to start application
        
        PID:2900
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
      4⤵
      PID:1784
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
        5⤵
        
        PID:3264
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
      4⤵
      PID:1804
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
        5⤵
        
        PID:1696
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
      4⤵
      PID:652
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
        5⤵
        
        PID:3184
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
      4⤵
      PID:2092
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
        5⤵
        UAC bypass
        
        PID:1640
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
      4⤵
      PID:2992
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
        5⤵
        
        PID:1688
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c shutdown -r -t 10 -f
      4⤵
      PID:1856
    - - C:\Windows\SysWOW64\shutdown.exe
        
        shutdown -r -t 10 -f
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:2364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4228

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa395c055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
MD5 47b2c6613360b818825d076d14c051f7
SHA1 7df7304568313a06540f490bf3305cb89bc03e5c
SHA512 08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
MD5 e0811105475d528ab174dfdb69f935f3
SHA1 dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
SHA512 8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852
MD5 SHA1 SHA512

Submit Download

36665538-edc5-4a8c-b752-7128f9e43aa4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\36665538-edc5-4a8c-b752-7128f9e43aa4.tmp
Size 941B
SHA256 08144c644ca3e7f7a028c1b8d0823075877003019b90c7907db3ecd24faaa1e7
MD5 53ad4f859a25621fc4a89a90ce4d5079
SHA1 28e7059e5d5dd02a1fdc16c8387b8186b808773a
SHA512 e305db0602304084346c3209935a140d8c2870fb744b95c907b333f177628195cb1a52a8c9d5de075b6fc920a3264a9ab90765e8792ae0ac847a630d6c92950c
MD5 SHA1 SHA512

Submit Download

7ff74ed7-e274-4433-9b4f-d486bc737d95.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7ff74ed7-e274-4433-9b4f-d486bc737d95.tmp
Size 6KB
SHA256 d5bc110f647d0cd8a1181690db431094d04ebd857ffa12a49cb6b222356723f1
MD5 dff85280625466060255eb9dc069a813
SHA1 f49a3cf076f9ca20743498464fee6d4c170aeae5
SHA512 0951333f430b884f1b5fb51b64d03ca77ba72fb0b2c8129a0d9495b034d88cdfde43b7025eb4bd4fbb489aef18cb3baa93b2892ed5f0754a181717a0d8760692
SSDEEP 96:npktt1dUwpvWMoiVmdeH0QXJUWQyV+VD7ziEwb:npkjXUGWMX9Jrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 64702855b54084b0c52d815fd8201c324725637ed4bf7cede1581e84310d09d7
MD5 72f48a308f314fcb25fcc62d1de697a6
SHA1 69b97c42fc100ffb15ab078180898a6b5792eb9e
SHA512 cf1bbcfc8e0d23b51a83c1686be4c8dee5c2713defc01b95da35875f3c7793026582568d6cff682104a591b7213ddf7a5048f6327f7625790402c8d5d8affb82
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 819f49f71d64cdfc764f906d67e78a804eebf6678c8b9bc2f1c77a26e09a6a67
MD5 8da2c6a5ddad706c2c45c4c4ca486250
SHA1 955a137ad5dfe64a4ee322395958a8b0872a1204
SHA512 3b3a8a5060d99128e09b6913321a3785841a83264a0fdd4f376590e10b169b5817b1933b26f5ec6be5d7a61f6704c3c21111052e3cec0c66ea3b80dfb533a31f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0e274139e30525740d9a2d98bad0d70902b7ddf275db0dfda793f47d7403dae2
MD5 4c5939aac62c68f5daf309d76f5b01d0
SHA1 59ab8f8e80ded6d528edcf9cd345596cf7d9d8ec
SHA512 9cb1817981158dab234e75bc77f512d9f948c42f09020b6a8225f217f90eb8cb671ef9efefe962b2173c9984e858de27f52c141220828810df043cb7ee099d09
SSDEEP 96:npkot1dUwpvWMoiVmdetuY1j07XJUWQyV+VD7AiEwb:npkUXUGWM9uYhcJrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 72eb7aaea56e2879a14311226d7a16eb2d0e3c1fa01793f7b3268f0e2ab27999
MD5 466af07bfda87aa01af73b2547a709f4
SHA1 68f9f2f8e2cbcd26bc19cb0684b890d9855a5e0a
SHA512 77fdc55400b647c2ac5ee9ef25dc619dca011a6f906a6b9a597640bf400fb7fea4053e3475bec24d6e4ff64b14fef3cf079032a7006c743c39b514a5911f274d
SSDEEP 96:npkbt11kwpZgWMoiLR5mde2u31xuY1j0HXJUWQyV+VD7AiEwb:npkh7kKgWMLMu3buYhcJrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 340e68d1bd9f22930cde039dc7983f7db0181cbcd209599ac2e36282cd181adb
MD5 4833b2285b6c2c020ee958b80d3bb9a7
SHA1 ed7546299d4b091d84de17ae8f34464129899518
SHA512 628021c23b5a7dfdcf17347b0d7cc8b478b567b6e7cc5f1753111bfd4ac4cab94942e10539189597674790a01bfc377ea36b683a959de0bcf3886a557fbb4334
SSDEEP 96:npkyt1dUwpvWMoiLR5mdetuY1j07XJUWQyV+VD7AiEwb:npkWXUGWMLPuYhcJrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 93446257489945c6d387573bf9b6af82d3bfe14f5b1e415081dece2501ea15b1
MD5 3ad1f667c10475fb8a2b7f864bd84424
SHA1 e14400053fa6209c34a74c15fd3109de19c27fd1
SHA512 360da56702b14ddeec1e927d4d2cd3b928523f5b12345755ba64fd0a59afb5c10e2f8bea35c6a4664db9e8f18e02f122ea68331333ce3b8d8faf8c06a91a15b1
SSDEEP 96:npket11RwpZgWMoiaRfR5mde2u31xuY1j0HXJUWQyV+VD7AiEwb:npkC7RKgWMaBMu3buYhcJrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 5fb38d62ddd5417437a8acb1759395fde62ec25a9a691a52b60c5211ac17b14b
MD5 84ef22ea817ef2411855b9d5f667518a
SHA1 235b0fdf540f89924a5bbb4d1055af7583d07c5c
SHA512 0edfd6fa50b42f8b0f924d2a1e165226f0242c5c4e48d752ee059c0c25d9dbe0bed1e50581fa5791259542030fbdbde14f9d109b78b4b79ef42689f4828c5b0c
SSDEEP 96:npk8sQIt11RwpZgWMoiaRfR5mdeMsbd4u31xuY1j0SXJUWQyV+VD7AiEwb:npkB7RKgWMaB2sbqu3buYhBJrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 528c4717d14718e7fbdfa772b93b6510e6a9505ecafc8636ada816ff7a0231e6
MD5 0ff8a1125a291ff9375d10af34bf698c
SHA1 eaab29db0a1e6f2cc120d4e3ba7e133c07c99326
SHA512 c03371182a351870e25d06c0edc5c92fe829b3696d698f1801314e757c148b58d41cfa8ea22567024382371b48e8342cacbf4b5bec07d4df0739e684dbc001e6
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 9d927e17a287a9cd71faea8c8d4cac708c092de4ec32b463c3865742941d6718
MD5 3c615d215758bc0b6691af43ea105798
SHA1 fdb58fd962aacc23718975eba375e38de970016b
SHA512 f35af4b7a627b6efc1ff5074e6fae6b55356507950d7100b385eb2bb2ead673260d3752d58f92319100870abd61cd2abb540d25e01611fcc54401b6cfbcab18e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 22207383d23a0ecb1be6ade018a344ee00031a68f9b7eece09ecdb3962e7114f
MD5 e94b481979b6844ef71a64e540e313bc
SHA1 6f8191b4a45f440ee5616e1dbb2092283e7ab3dc
SHA512 e5e285d9fa485072230dcd2c82dc3d4bfdb1396acc89947fdf18135fd7ac4905667d27dc7d3bc50ab3a067c6c6f81bda05e97b58ad10f4adc749d0e898328307
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe580356.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580356.TMP
Size 536B
SHA256 0313377f9c6459f12c502900478c4dd32f2a08c127c425befc4d96d9e5d387fd
MD5 7989a3772751252418a659475de3d137
SHA1 08c6d762da2ce40eb048a93a8edce547a6291fb0
SHA512 7e02d6ee21b4f8deb07a01dd725b1ab505afa321cdbf29e36a29e6c41b925c93e82230316627932dc7b72f618acd25ecb560d16ef14c9edafb3b2e23aab74f6e
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d75166ac20922ed1fa9f60fb2f4d976c995d2d667f47bde50e315397f3cbcfe2
MD5 ebad38efc9d8ddd25cdbd708c76a0ea1
SHA1 d280ad80b2fd44e930dbb04435db5c8faea5ee47
SHA512 0bc380da0e72e4da5be676897203ca3a815e28518ecba802374935a58f9b10b242755fa91498a899fcf68896ea2bba7fb5d3dddc48f29c633813101224fda24b
SSDEEP 192:ZoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSY9W2RU+SFlsGUbXRznIYp:F9iIxuERzA83h09RZxYT10SGCRzIDG86
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a7e77bee2cd9cd7fffdf46fd16de76a436ec6b4c9c7d3742486e0ef5cf28a2c9
MD5 2b51f99894510a147d74f17b476c34cc
SHA1 a386c1c11e575f24be6c2f78c201ea9dec9d867d
SHA512 8adaa2b3dd141d5eb4cc8bb24f606077ab03e9c476d1ee21701c971710cba9d5f91ccabf5effddd946f37afc3f1787f9760fbadf9cae24bdb009511e13ceccf8
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSY6e2RU8xbXPznIYWLSDgs:A9iIxuERzA83h09RZxYaLPzIDG86
MD5 SHA1 SHA512 SSDEEP

Submit Download

del.bat

Path C:\Users\Admin\AppData\Local\del.bat
Size 56B
SHA256 d31225722321313554e736bcd9debc4cb4c5ed6dce3921fa7839162fede832b6
MD5 f62904abb27a3574e2e6121349ab4955
SHA1 35b3504f1d6bc88638a0721cf3d898eb0f95092a
SHA512 e8d1cf4c6a745790b2eaf4b3618703337313e3f561ba88982bc1a139aa4b5b29fd5f78f925e5bd12669eed74ca78510f6d6b1ce091bc55299057d2b2e867fb4e
MD5 SHA1 SHA512

Submit Download

system.exe

Path C:\Users\Admin\AppData\Local\system.exe
Size 315KB
SHA256 82dd20f49584477101b253a09465f6cc7d675f77ba9a92d1116ea7e3ba2343d4
MD5 5030807b78c82a1d320d03abb33eb6c8
SHA1 4da77062bfb2068c353de1bff38c9e16632952f6
SHA512 bf6434e8343972d3aa896879555c1fe664e6d96e6c37685928ebfac7960312fc7ca5716eaefaaa43283edf749ef484f71fa1a0d4cc2f612bf9c6c2bb65cdccf4
SSDEEP 6144:BswDdb2MemnBVlz0SoVbO4A6OA4Trl28TyT6llY1/I8cWJWlfTXvd:BswRSslz0P1OdFXJlJ8buXvd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 306821.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 306821.crdownload
Size 315KB
SHA256 7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5
MD5 9f8bc96c96d43ecb69f883388d228754
SHA1 61ed25a706afa2f6684bb4d64f69c5fb29d20953
SHA512 550a891c1059f58aa983138caf65a7ea9c326cb1b94c15f3e7594128f6e9f1295b9c2dbc0925637dba7c94e938083fffc6a63dc7c2e5b1e247679931cce505c6
SSDEEP 6144:BswDdb2MemnBVlz0SoVbO4A6OA4Trl28TyT6llY1/I8cWJWlfTXv:BswRSslz0P1OdFXJlJ8buXv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads