chaos | b98ba4f48ad58a55a79732eea1f80838bc26dc0ab3ba0403d04a3c25df9c3d08

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2024 09:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8392650851d29f54e051d8a6499889a5.exe
Size

2.3MB
MD5

8392650851d29f54e051d8a6499889a5
SHA1

d5814cff46164e3011bfce0d3bd7f6692ec63c64
SHA256

b98ba4f48ad58a55a79732eea1f80838bc26dc0ab3ba0403d04a3c25df9c3d08
SHA512

f518039b485bc675383c11b435f2b6eab2dd8d1ffac3e0aed29d972effedeb69aa039191b0986a05c275a9ccb2d65d0efc98a21db96c9cde2c54a8fa3f0f1cd8
SSDEEP

49152:4EWDvY84YWarHKnuQDuZu/RJJlB8xsDDckz8YKBg1i1IIMoq:OxkDumRJJlQuDcXMDJ

Score

10^/10

chaos hermeticwiper xworm zgrat persistence ransomware rat trojan wiper

Malware Config

Extracted

Family

xworm

Version

3.1

gamemodz.duckdns.org:4678

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\qvyfov.exe	family_chaos
behavioral2/memory/1624-4924-0x0000000000F90000-0x0000000000FAC000-memory.dmp	family_chaos

Detect HermeticWiper 1 IoCs

Detect HermeticWiper Payload.

wiper

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\eymlmh.exe	family_hermeticwiper

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4732-4895-0x0000000000400000-0x0000000000418000-memory.dmp	family_xworm

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5040-2-0x0000000006B60000-0x0000000006D86000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-5-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-6-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-8-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-10-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-12-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-14-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-16-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-18-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-20-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-22-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-24-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-26-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-28-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-30-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-32-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-34-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-36-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-38-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-40-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-42-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-44-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-46-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-48-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-50-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-52-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-54-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-58-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-60-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-56-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-62-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-64-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-66-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-68-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1

HermeticWiper
HermeticWiper is a partition-corrupting malware used in cyberattacks against Ukrainian organizations.
wiper hermeticwiper
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Drops file in Drivers directory 3 IoCs

Processes:

eymlmh.exe

description	ioc	process
File created	C:\Windows\system32\Drivers\dbdr	eymlmh.exe
File opened for modification	C:\Windows\system32\Drivers\dbdr	eymlmh.exe
File created	C:\Windows\system32\Drivers\dbdr.sys	eymlmh.exe

Drops startup file 2 IoCs

Processes:

cvtres.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvtres.lnk	cvtres.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvtres.lnk	cvtres.exe

Executes dropped EXE 4 IoCs

Processes:

cvtres.execvtres.exeqvyfov.exeeymlmh.exe

pid process

448 cvtres.exe
3320 cvtres.exe
1624 qvyfov.exe
2356 eymlmh.exe

pid	process
448	cvtres.exe
3320	cvtres.exe
1624	qvyfov.exe
2356	eymlmh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

cvtres.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cvtres = "C:\\Users\\Admin\\AppData\\Roaming\\cvtres.exe"	cvtres.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

36 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

8392650851d29f54e051d8a6499889a5.exe

description pid process target process

PID 5040 set thread context of 4732 5040 8392650851d29f54e051d8a6499889a5.exe cvtres.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1100 schtasks.exe

flow	ioc
36	ip-api.com

description	pid	process	target process
PID 5040 set thread context of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	cvtres.exe

pid	process
1100	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

qvyfov.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
2688	msedge.exe
2688	msedge.exe
1904	msedge.exe
1904	msedge.exe
1184	identity_helper.exe
1184	identity_helper.exe

Suspicious behavior: LoadsDriver 5 IoCs

Processes:

pid process

652
652
652
652
652
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1904 msedge.exe
1904 msedge.exe
1904 msedge.exe
1904 msedge.exe
1904 msedge.exe
1904 msedge.exe

pid	process
652
652
652
652
652

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

8392650851d29f54e051d8a6499889a5.execvtres.exeqvyfov.exeeymlmh.exe

description	pid	process
Token: SeDebugPrivilege	5040	8392650851d29f54e051d8a6499889a5.exe
Token: SeDebugPrivilege	5040	8392650851d29f54e051d8a6499889a5.exe
Token: SeDebugPrivilege	4732	cvtres.exe
Token: SeDebugPrivilege	4732	cvtres.exe
Token: SeDebugPrivilege	1624	qvyfov.exe
Token: 0	2356	eymlmh.exe
Token: SeBackupPrivilege	2356	eymlmh.exe
Token: SeLoadDriverPrivilege	2356	eymlmh.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8392650851d29f54e051d8a6499889a5.execvtres.exemsedge.exe

description	pid	process	target process
PID 5040 wrote to memory of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	cvtres.exe
PID 5040 wrote to memory of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	cvtres.exe
PID 5040 wrote to memory of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	cvtres.exe
PID 5040 wrote to memory of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	cvtres.exe
PID 5040 wrote to memory of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	cvtres.exe
PID 5040 wrote to memory of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	cvtres.exe
PID 5040 wrote to memory of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	cvtres.exe
PID 5040 wrote to memory of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	cvtres.exe
PID 4732 wrote to memory of 1100	4732	cvtres.exe	schtasks.exe
PID 4732 wrote to memory of 1100	4732	cvtres.exe	schtasks.exe
PID 4732 wrote to memory of 1100	4732	cvtres.exe	schtasks.exe
PID 4732 wrote to memory of 1624	4732	cvtres.exe	qvyfov.exe
PID 4732 wrote to memory of 1624	4732	cvtres.exe	qvyfov.exe
PID 4732 wrote to memory of 1904	4732	cvtres.exe	msedge.exe
PID 4732 wrote to memory of 1904	4732	cvtres.exe	msedge.exe
PID 1904 wrote to memory of 2184	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 2184	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 3620	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 2688	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 2688	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 424	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 424	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 424	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 424	1904	msedge.exe	msedge.exe
PID 1904 wrote to memory of 424	1904	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\8392650851d29f54e051d8a6499889a5.exe
"C:\Users\Admin\AppData\Local\Temp\8392650851d29f54e051d8a6499889a5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "cvtres" /tr "C:\Users\Admin\AppData\Roaming\cvtres.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\qvyfov.exe
    "C:\Users\Admin\AppData\Local\Temp\qvyfov.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://i.imgflip.com/1p7cdj.jpg
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbdc5846f8,0x7ffbdc584708,0x7ffbdc584718
      4⤵
      PID:2184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
      4⤵
      PID:3620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
      4⤵
      PID:424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
      4⤵
      PID:3192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
      4⤵
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
      4⤵
      PID:2224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
      4⤵
      PID:620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
      4⤵
      PID:3836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
      4⤵
      PID:968
- - C:\Users\Admin\AppData\Local\Temp\eymlmh.exe
    "C:\Users\Admin\AppData\Local\Temp\eymlmh.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2356

C:\Users\Admin\AppData\Roaming\cvtres.exe
C:\Users\Admin\AppData\Roaming\cvtres.exe
1⤵
- Executes dropped EXE
PID:448

C:\Users\Admin\AppData\Roaming\cvtres.exe
C:\Users\Admin\AppData\Roaming\cvtres.exe
1⤵
- Executes dropped EXE
PID:3320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\041c7abd-43fa-40e5-a81a-41817a3eba91.tmp

Filesize
6KB

MD5
c606d14c42f431792f163cabc1ffd016

SHA1
b7a0813f4e26de381aff73a66c9b9dbc80b67f03

SHA256
a57be5fb0a74b3b5794549847fdc9122037262a32b390e73bc9fc6e2463ed99a

SHA512
015f0815493c98f18fbac82149d55a37e594547cedb4cf9e6cfecee6ca27995d39773693170a0b62026241d07cb00dac2c84f99b5608a60e7b097a65a5faacfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57b5d705295b86c2c19edfb52ff110fd

SHA1
090fd22403b9626a5294835952267036a970bbfc

SHA256
f666b7eac252c89b69c412c004b4ee78c719b0182b021e5bff5443996a923440

SHA512
090e11269155f8e8c221b10a78ca0c7bdc50ffcd7f90408bf8796ac7b4f0ba14cde6d925c40e32ca32ec0401338a40b34c7d71daa061beb52cc0e1525e213f2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6d124b649f788540bcf37951f7fa4300

SHA1
059c0b4ccb29e3184d41fd12f26ed54e78e19351

SHA256
c97d6a6567246343dd5f1e1f4784b1a31821a6e11ed107461c19db15740463b7

SHA512
8f52a33105c25142f2373d8a1e5e4fa8a66e406d458c04ee5d8ce2325130583ac82e79447fa5d04051f158e367339611c9afe05481a1248234bcadcd510ef731

Download Submit
C:\Users\Admin\AppData\Local\Temp\eymlmh.exe

Filesize
114KB

MD5
3f4a16b29f2f0532b7ce3e7656799125

SHA1
61b25d11392172e587d8da3045812a66c3385451

SHA256
1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591

SHA512
32acaceda42128ef9e0a9f36ee2678d2fc296fda2df38629eb223939c8a9352b3bb2b7021bb84e9f223a4a26df57b528a711447b1451213a013fe00f9b971d80

Download Submit
C:\Users\Admin\AppData\Local\Temp\qvyfov.exe

Filesize
84KB

MD5
7051dcbe9a0837a312b09a5ae3b42430

SHA1
3553ff8725a57929e438228bf141b695c13cecb4

SHA256
ce750c7054359e9e88556d48f7eea341374b74f494caed48251185b54c9ed644

SHA512
2e82160bff1fbdd6f6a9f0210dfaf831650fdefdf8e3bb70c3c2717122b107ef3610c5c5f55908843df7ba3bd3bbefc40b9d1dda07877083cbd2ab8b090a276c

Download Submit
C:\Users\Admin\AppData\Roaming\cvtres.exe

Filesize
45KB

MD5
70d838a7dc5b359c3f938a71fad77db0

SHA1
66b83eb16481c334719eed406bc58a3c2b910923

SHA256
e4dbdbf7888ea96f3f8aa5c4c7f2bcf6e57d724dd8194fe5f35b673c6ef724ea

SHA512
9c9a945db5b5e7ff8105bfe74578e6f00b5f707f7c3d8f1f1fb41553a6d0eab29cef026e77877a1ad6435fa7bc369141921442e1485f2b0894c6bbcbd7791034

Download Submit
\??\pipe\LOCAL\crashpad_1904_PJNDXMBDXVMUPNSJ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1624-4926-0x00007FFBCB730000-0x00007FFBCC1F1000-memory.dmp

Filesize
10.8MB

Download
memory/1624-4925-0x00007FFBCB730000-0x00007FFBCC1F1000-memory.dmp

Filesize
10.8MB

Download
memory/1624-4924-0x0000000000F90000-0x0000000000FAC000-memory.dmp

Filesize
112KB

Download
memory/4732-4953-0x0000000005FE0000-0x0000000005FEA000-memory.dmp

Filesize
40KB

Download
memory/4732-4910-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/4732-4909-0x0000000074530000-0x0000000074CE0000-memory.dmp

Filesize
7.7MB

Download
memory/4732-4894-0x0000000074530000-0x0000000074CE0000-memory.dmp

Filesize
7.7MB

Download
memory/4732-4898-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/4732-4897-0x00000000050F0000-0x0000000005156000-memory.dmp

Filesize
408KB

Download
memory/4732-4896-0x0000000005050000-0x00000000050EC000-memory.dmp

Filesize
624KB

Download
memory/4732-4895-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/5040-26-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-4893-0x0000000074530000-0x0000000074CE0000-memory.dmp

Filesize
7.7MB

Download
memory/5040-40-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-42-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-44-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-46-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-48-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-50-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-52-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-54-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-58-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-60-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-56-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-62-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-64-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-66-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-68-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-3335-0x0000000074530000-0x0000000074CE0000-memory.dmp

Filesize
7.7MB

Download
memory/5040-4887-0x00000000058D0000-0x00000000058D1000-memory.dmp

Filesize
4KB

Download
memory/5040-4886-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/5040-4888-0x0000000007110000-0x0000000007172000-memory.dmp

Filesize
392KB

Download
memory/5040-4889-0x0000000006FB0000-0x0000000006FFC000-memory.dmp

Filesize
304KB

Download
memory/5040-4890-0x00000000072B0000-0x0000000007304000-memory.dmp

Filesize
336KB

Download
memory/5040-38-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-36-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-34-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-32-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-30-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-28-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-0-0x0000000000C60000-0x0000000000EAA000-memory.dmp

Filesize
2.3MB

Download
memory/5040-24-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-22-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-20-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-18-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-16-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-14-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-12-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-10-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-8-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-6-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-5-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Filesize
2.1MB

Download
memory/5040-4-0x0000000006D80000-0x0000000006E12000-memory.dmp

Filesize
584KB

Download
memory/5040-3-0x0000000007330000-0x00000000078D4000-memory.dmp

Filesize
5.6MB

Download
memory/5040-2-0x0000000006B60000-0x0000000006D86000-memory.dmp

Filesize
2.1MB

Download
memory/5040-1-0x0000000074530000-0x0000000074CE0000-memory.dmp

Filesize
7.7MB

Download