chaos | b98ba4f48ad58a55a79732eea1f80838bc26dc0ab3ba0403d04a3c25df9c3d08

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8392650851d29f54e051d8a6499889a5.exe
Size 2.3MB
Sample240406-lbbqaafg92
SHA256 b98ba4f48ad58a55a79732eea1f80838bc26dc0ab3ba0403d04a3c25df9c3d08
MD5 8392650851d29f54e051d8a6499889a5
SHA1 d5814cff46164e3011bfce0d3bd7f6692ec63c64
SHA512 f518039b485bc675383c11b435f2b6eab2dd8d1ffac3e0aed29d972effedeb69aa039191b0986a05c275a9ccb2d65d0efc98a21db96c9cde2c54a8fa3f0f1cd8
SSDEEP 49152:4EWDvY84YWarHKnuQDuZu/RJJlB8xsDDckz8YKBg1i1IIMoq:OxkDumRJJlQuDcXMDJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

chaos hermeticwiper xworm zgrat persistence ransomware rat trojan wiper

Malware Config

Extracted

Family

xworm

Version

gamemodz.duckdns.org:4678

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 2 IoCs

resource	yara_rule
behavioral2/files/0x0003000000000707-4917.dat	family_chaos
behavioral2/memory/1624-4924-0x0000000000F90000-0x0000000000FAC000-memory.dmp	family_chaos

Detect HermeticWiper 1 IoCs

Detect HermeticWiper Payload.

wiper

resource	yara_rule
behavioral2/files/0x000600000001da08-4970.dat	family_hermeticwiper

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4732-4895-0x0000000000400000-0x0000000000418000-memory.dmp	family_xworm

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/5040-2-0x0000000006B60000-0x0000000006D86000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-5-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-6-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-8-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-10-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-12-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-14-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-16-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-18-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-20-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-22-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-24-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-26-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-28-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-30-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-32-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-34-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-36-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-38-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-40-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-42-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-44-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-46-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-48-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-50-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-52-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-54-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-58-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-60-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-56-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-62-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-64-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-66-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1
behavioral2/memory/5040-68-0x0000000006B60000-0x0000000006D7F000-memory.dmp	family_zgrat_v1

HermeticWiper
HermeticWiper is a partition-corrupting malware used in cyberattacks against Ukrainian organizations.
wiper hermeticwiper
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\dbdr	eymlmh.exe
File opened for modification	C:\Windows\system32\Drivers\dbdr	eymlmh.exe
File created	C:\Windows\system32\Drivers\dbdr.sys	eymlmh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvtres.lnk	cvtres.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvtres.lnk	cvtres.exe

Executes dropped EXE 4 IoCs

pid	Process
448	cvtres.exe
3320	cvtres.exe
1624	qvyfov.exe
2356	eymlmh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cvtres = "C:\\Users\\Admin\\AppData\\Roaming\\cvtres.exe"	cvtres.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
36	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5040 set thread context of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	97

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1100	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
1624	qvyfov.exe
2688	msedge.exe
2688	msedge.exe
1904	msedge.exe
1904	msedge.exe
1184	identity_helper.exe
1184	identity_helper.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	8392650851d29f54e051d8a6499889a5.exe
Token: SeDebugPrivilege	5040	8392650851d29f54e051d8a6499889a5.exe
Token: SeDebugPrivilege	4732	cvtres.exe
Token: SeDebugPrivilege	4732	cvtres.exe
Token: SeDebugPrivilege	1624	qvyfov.exe
Token: 0	2356	eymlmh.exe
Token: SeBackupPrivilege	2356	eymlmh.exe
Token: SeLoadDriverPrivilege	2356	eymlmh.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	97
PID 5040 wrote to memory of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	97
PID 5040 wrote to memory of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	97
PID 5040 wrote to memory of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	97
PID 5040 wrote to memory of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	97
PID 5040 wrote to memory of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	97
PID 5040 wrote to memory of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	97
PID 5040 wrote to memory of 4732	5040	8392650851d29f54e051d8a6499889a5.exe	97
PID 4732 wrote to memory of 1100	4732	cvtres.exe	98
PID 4732 wrote to memory of 1100	4732	cvtres.exe	98
PID 4732 wrote to memory of 1100	4732	cvtres.exe	98
PID 4732 wrote to memory of 1624	4732	cvtres.exe	104
PID 4732 wrote to memory of 1624	4732	cvtres.exe	104
PID 4732 wrote to memory of 1904	4732	cvtres.exe	108
PID 4732 wrote to memory of 1904	4732	cvtres.exe	108
PID 1904 wrote to memory of 2184	1904	msedge.exe	109
PID 1904 wrote to memory of 2184	1904	msedge.exe	109
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 3620	1904	msedge.exe	110
PID 1904 wrote to memory of 2688	1904	msedge.exe	111
PID 1904 wrote to memory of 2688	1904	msedge.exe	111
PID 1904 wrote to memory of 424	1904	msedge.exe	112
PID 1904 wrote to memory of 424	1904	msedge.exe	112
PID 1904 wrote to memory of 424	1904	msedge.exe	112
PID 1904 wrote to memory of 424	1904	msedge.exe	112
PID 1904 wrote to memory of 424	1904	msedge.exe	112

C:\Users\Admin\AppData\Local\Temp\8392650851d29f54e051d8a6499889a5.exe
"C:\Users\Admin\AppData\Local\Temp\8392650851d29f54e051d8a6499889a5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "cvtres" /tr "C:\Users\Admin\AppData\Roaming\cvtres.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\qvyfov.exe
    "C:\Users\Admin\AppData\Local\Temp\qvyfov.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://i.imgflip.com/1p7cdj.jpg
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbdc5846f8,0x7ffbdc584708,0x7ffbdc584718
      4⤵
      PID:2184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
      4⤵
      PID:3620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
      4⤵
      PID:424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
      4⤵
      PID:3192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
      4⤵
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
      4⤵
      PID:2224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
      4⤵
      PID:620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
      4⤵
      PID:3836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,336991599916081636,6668810350516431485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
      4⤵
      PID:968
- - C:\Users\Admin\AppData\Local\Temp\eymlmh.exe
    "C:\Users\Admin\AppData\Local\Temp\eymlmh.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2356

C:\Users\Admin\AppData\Roaming\cvtres.exe
C:\Users\Admin\AppData\Roaming\cvtres.exe
1⤵
- Executes dropped EXE
PID:448

C:\Users\Admin\AppData\Roaming\cvtres.exe
C:\Users\Admin\AppData\Roaming\cvtres.exe
1⤵
- Executes dropped EXE
PID:3320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
MD5 e1b45169ebca0dceadb0f45697799d62
SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
MD5 9ffb5f81e8eccd0963c46cbfea1abc20
SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
MD5 SHA1 SHA512

Submit Download

041c7abd-43fa-40e5-a81a-41817a3eba91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\041c7abd-43fa-40e5-a81a-41817a3eba91.tmp
Size 6KB
SHA256 a57be5fb0a74b3b5794549847fdc9122037262a32b390e73bc9fc6e2463ed99a
MD5 c606d14c42f431792f163cabc1ffd016
SHA1 b7a0813f4e26de381aff73a66c9b9dbc80b67f03
SHA512 015f0815493c98f18fbac82149d55a37e594547cedb4cf9e6cfecee6ca27995d39773693170a0b62026241d07cb00dac2c84f99b5608a60e7b097a65a5faacfa
SSDEEP 96:nxkQA1Z2wpvWMoiVmdeHOHTsGUWQyV+VD7ziEwb:nxkJz2GWMXETjrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f666b7eac252c89b69c412c004b4ee78c719b0182b021e5bff5443996a923440
MD5 57b5d705295b86c2c19edfb52ff110fd
SHA1 090fd22403b9626a5294835952267036a970bbfc
SHA512 090e11269155f8e8c221b10a78ca0c7bdc50ffcd7f90408bf8796ac7b4f0ba14cde6d925c40e32ca32ec0401338a40b34c7d71daa061beb52cc0e1525e213f2c
SSDEEP 96:nxkkA1Z2wpvWMoiVmdeKuOS1jOHT9GUWQyV+VD7AiEwb:nxktz2GWMau5hETorg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c97d6a6567246343dd5f1e1f4784b1a31821a6e11ed107461c19db15740463b7
MD5 6d124b649f788540bcf37951f7fa4300
SHA1 059c0b4ccb29e3184d41fd12f26ed54e78e19351
SHA512 8f52a33105c25142f2373d8a1e5e4fa8a66e406d458c04ee5d8ce2325130583ac82e79447fa5d04051f158e367339611c9afe05481a1248234bcadcd510ef731
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDe2RUCxI4bRyxvFt2pTEE0:A9iIxuERzA83h09RZxYTCoyTt2h3CoY
MD5 SHA1 SHA512 SSDEEP

Submit Download

eymlmh.exe

Path C:\Users\Admin\AppData\Local\Temp\eymlmh.exe
Size 114KB
SHA256 1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591
MD5 3f4a16b29f2f0532b7ce3e7656799125
SHA1 61b25d11392172e587d8da3045812a66c3385451
SHA512 32acaceda42128ef9e0a9f36ee2678d2fc296fda2df38629eb223939c8a9352b3bb2b7021bb84e9f223a4a26df57b528a711447b1451213a013fe00f9b971d80
SSDEEP 1536:sBOoa7Nn52wurilmw9BgjKu1sPPxaSLyqC:sBOoa7P2wxlPwV1qPkSuqC
MD5 SHA1 SHA512 SSDEEP

Submit Download

qvyfov.exe

Path C:\Users\Admin\AppData\Local\Temp\qvyfov.exe
Size 84KB
SHA256 ce750c7054359e9e88556d48f7eea341374b74f494caed48251185b54c9ed644
MD5 7051dcbe9a0837a312b09a5ae3b42430
SHA1 3553ff8725a57929e438228bf141b695c13cecb4
SHA512 2e82160bff1fbdd6f6a9f0210dfaf831650fdefdf8e3bb70c3c2717122b107ef3610c5c5f55908843df7ba3bd3bbefc40b9d1dda07877083cbd2ab8b090a276c
SSDEEP 1536:Zo2eMtPr9b/u+hCnbKeg7hISAv8Iz/xYnPCiPlNE927Zk5L+:Zo5MtPr9b/u+yoza/xYPCSc27ZIL+
MD5 SHA1 SHA512 SSDEEP

Submit Download

cvtres.exe

Path C:\Users\Admin\AppData\Roaming\cvtres.exe
Size 45KB
SHA256 e4dbdbf7888ea96f3f8aa5c4c7f2bcf6e57d724dd8194fe5f35b673c6ef724ea
MD5 70d838a7dc5b359c3f938a71fad77db0
SHA1 66b83eb16481c334719eed406bc58a3c2b910923
SHA512 9c9a945db5b5e7ff8105bfe74578e6f00b5f707f7c3d8f1f1fb41553a6d0eab29cef026e77877a1ad6435fa7bc369141921442e1485f2b0894c6bbcbd7791034
SSDEEP 768:bINyGPbIriyUAfETlzjpyXcZ0R55GhrdRMJmcBkmcrH+ihBy3kM:3GjyUAfWNkFR5GTMJhkmM+wBxM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1624-4926-0x00007FFBCB730000-0x00007FFBCC1F1000-memory.dmp

Download

memory/1624-4925-0x00007FFBCB730000-0x00007FFBCC1F1000-memory.dmp

Download

memory/1624-4924-0x0000000000F90000-0x0000000000FAC000-memory.dmp

Download

memory/4732-4953-0x0000000005FE0000-0x0000000005FEA000-memory.dmp

Download

memory/4732-4910-0x0000000005370000-0x0000000005380000-memory.dmp

Download

memory/4732-4909-0x0000000074530000-0x0000000074CE0000-memory.dmp

Download

memory/4732-4894-0x0000000074530000-0x0000000074CE0000-memory.dmp

Download

memory/4732-4898-0x0000000005370000-0x0000000005380000-memory.dmp

Download

memory/4732-4897-0x00000000050F0000-0x0000000005156000-memory.dmp

Download

memory/4732-4896-0x0000000005050000-0x00000000050EC000-memory.dmp

Download

memory/4732-4895-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/5040-26-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-4893-0x0000000074530000-0x0000000074CE0000-memory.dmp

Download

memory/5040-40-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-42-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-44-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-46-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-48-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-50-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-52-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-54-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-58-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-60-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-56-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-62-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-64-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-66-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-68-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-3335-0x0000000074530000-0x0000000074CE0000-memory.dmp

Download

memory/5040-4887-0x00000000058D0000-0x00000000058D1000-memory.dmp

Download

memory/5040-4886-0x0000000005920000-0x0000000005930000-memory.dmp

Download

memory/5040-4888-0x0000000007110000-0x0000000007172000-memory.dmp

Download

memory/5040-4889-0x0000000006FB0000-0x0000000006FFC000-memory.dmp

Download

memory/5040-4890-0x00000000072B0000-0x0000000007304000-memory.dmp

Download

memory/5040-38-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-36-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-34-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-32-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-30-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-28-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-0-0x0000000000C60000-0x0000000000EAA000-memory.dmp

Download

memory/5040-24-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-22-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-20-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-18-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-16-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-14-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-12-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-10-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-8-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-6-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-5-0x0000000006B60000-0x0000000006D7F000-memory.dmp

Download

memory/5040-4-0x0000000006D80000-0x0000000006E12000-memory.dmp

Download

memory/5040-3-0x0000000007330000-0x00000000078D4000-memory.dmp

Download

memory/5040-2-0x0000000006B60000-0x0000000006D86000-memory.dmp

Download

memory/5040-1-0x0000000074530000-0x0000000074CE0000-memory.dmp

Download